topic Re: URL Filtering - Blocks msn live and yahoo messenger in General Topics

URL Filtering - Blocks msn live and yahoo messenger

eugene — Mon, 18 Jan 2010 04:53:59 GMT

Hi All,

I wonder if anyone is facing this issue... If you enable web-based-email inside ssl decryption rules, it will also block user to access both msn live messenger and yahoo messenger (this does not happen to skype of course). Even though, the existing security rules stated allow any application without any filtering mode, this will still happen.

Pan-os: 3.0.5

application version: 163-489

threat version: 163-489

url filtering version: 3247

Any workaround?

Thanks.

Re: URL Filtering - Blocks msn live and yahoo messenger

nrice — Mon, 18 Jan 2010 19:15:51 GMT

Eugene,

If you've determined that your Yahoo and MSN IM sessions are being blocked by the filter on Web-based-email, Support recommends that you allow login.yahoo.com and live.msn.com.

Re: URL Filtering - Blocks msn live and yahoo messenger

eugene — Thu, 21 Jan 2010 08:20:28 GMT

Hi Nrice,

Thanks for your replied.

Nope, that is url filtering part, but the issue that i'm facing is with ssl decryption. Like i said, if you enable "web-based-email" category inside ssl decryption". I also tried using your method is the same.

In this case, how can we overcome this issue? As per now, there is no setting / configuration for us to whitelisting certain url as per ssl decryption category.

Re: URL Filtering - Blocks msn live and yahoo messenger

nrice — Thu, 21 Jan 2010 23:24:43 GMT

I ran this past Support and they recommend openeing a case so that they can work with you to get around the SSL decryption issue .

Re: URL Filtering - Blocks msn live and yahoo messenger

jochristian — Fri, 27 Apr 2012 07:24:51 GMT

Did you find a fix for this problem?
I'm having the same problem with 4.1.5 and ssl decryption. Can't login to msn.

Jo Christian

Re: URL Filtering - Blocks msn live and yahoo messenger

jochristian — Fri, 27 Apr 2012 08:15:06 GMT

So I found a fix for this problem.

Make a custom url category with *.msn.com and add it to a "no-decrypt" rule.

Jo Christian

Re: URL Filtering - Blocks msn live and yahoo messenger

mikand — Sat, 28 Apr 2012 11:20:44 GMT

To me that sounds bad because now all s**t at *.msn.com will bypass the protections that your PA can offer regarding threat and antivirus etc.

Re: URL Filtering - Blocks msn live and yahoo messenger

jochristian — Sat, 28 Apr 2012 11:34:59 GMT

Hello,

Yes I agree.

But I needed to find a fast fix and this was the solution.

I guess it is possible to tighten the url filter a bit by finding the correct somethingat.msn.com

But this will not be a perfect solution anyway.

Jo Christian