topic Re: Skype blocking in General Topics

Skype blocking

markk96 — Tue, 07 Oct 2014 16:26:35 GMT

I have found in testing that with blocking, the application 'skype' and 'skype-probe' if the user is not logged in the policy will block the user from signing into skype, but if the user is already signed into skype and plugs in behind the palo policy, the traffic log shows skype being blocked, but the user is still able to IM. Am I missing something?

Re: Skype blocking

ssharma — Tue, 07 Oct 2014 16:28:57 GMT

Hi Markk96,

Make sure you have enabled "Rematch Sessions" under Device -> Setup -> Session and commit. Test again and see if you get similar results. Thank you.

Re: Skype blocking

markk96 — Tue, 07 Oct 2014 16:32:07 GMT

Rematch Sessions is already checked. Anything else to check?

Re: Skype blocking

bat — Tue, 07 Oct 2014 16:35:43 GMT

Hi markk96

As per this article: How to Block SKYPE you should not block skype-probe: "Skype-probe needs to be allowed. Skype-probe runs over port 80 and is used to setup initial connections. When Skype-probe is blocked, the application will encrypt the communication and start using alternate open ports which is why it needs to be allowed."

Have you already tried that ?

Re: Skype blocking

bat — Tue, 07 Oct 2014 16:42:27 GMT

Please also go through this document: Skype is not Blocked for Computers Entering Network with Skype Already Signed In

Re: Skype blocking

markk96 — Tue, 07 Oct 2014 17:15:24 GMT

I removed skype-probe, i added msn-base, but still it is working, i guess when I get in the lab i will test this out further with unknown tcp and udp.

Re: Skype blocking

bat — Tue, 07 Oct 2014 17:17:40 GMT

Thanks for the update, do let us know how it goes

Re: Skype blocking

markk96 — Tue, 07 Oct 2014 17:26:16 GMT

I have tried, blocking skype, msn base, unknown tcp and udp, but chat still works, even tho skype looks like it is spinning, I am able to send and receive IMs.

Re: Skype blocking

hshah — Tue, 07 Oct 2014 17:28:51 GMT

HI Mark,

What application does firewall identify for chap? It would be great if you can provide us output for "show session id <>"

Regards,

Hardik Shah

Re: Skype blocking

markk96 — Tue, 07 Oct 2014 17:30:11 GMT

It looks like now it is going out on Insufficent-data. Not sure how to block that other then the tcp port.

Re: Skype blocking

hshah — Tue, 07 Oct 2014 17:31:59 GMT

Hi Mark,

In-sufficient data means firewall has not yet identified application. Firewall needs more packets for identification.

Firewall should detect application in some time.

Regards,

Hardik Shah

Re: Skype blocking

bat — Tue, 07 Oct 2014 17:32:52 GMT

Have you tried changing the service from "application-default" to "any" for those security rules ?

Re: Skype blocking

markk96 — Tue, 07 Oct 2014 17:40:54 GMT

I just changed it an no difference, uknown tcp was on port 37777 but now it is blocked and now it is insufficent data on port 37777, if i block the port, it just uses a different one.

Re: Skype blocking

bat — Tue, 07 Oct 2014 17:45:03 GMT

markk96 I see you have mentioned earlier that you removed "skype-probe" so is it not mentioned in any of the security rules ?

skype-probe should be allowed in one of the security rules for it to work as mentioned in the document.

Re: Skype blocking

markk96 — Tue, 07 Oct 2014 18:03:28 GMT

Skype-Probe is allowed via another policy rule.

Re: Skype blocking

markk96 — Wed, 08 Oct 2014 01:20:17 GMT

What I have found to fix is this even though I had skype-probe allowed, it was not above the skype deny policy.

Skype-Probe Allow

Skype Deny

Msn-base Deny

This fixed my issue.