topic Re: Need to Allow Video-Streaming from Specific Website in General Topics

Need to Allow Video-Streaming from Specific Website

Jafar_Hussain — Wed, 21 Oct 2020 06:47:45 GMT

Hello Dears,

Requirement:- I want to allow only some educational videos (educational videos belong from training and tools URL category) for my environment.

Below i have tried:-

I have checked all the streaming videos played on YouTube or any the streaming media category.
When we allow traffic for training and tools as well as streaming media category the website working fine.
But according to my requirement only learning video should be play rest should be block.
I have tried to achive my requirement by the below documents:-
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClikCAC
According to the documents to achieve my requirement there is one option “Overrides” in URL filtering. But unfortunately this option is not available in latest PAN-OS (“Override” option was available on previous version). my PAN OS is 9.1.3

Could you please suggest is there any other way to achive my requirement.

Thanks.

Re: Need to Allow Video-Streaming from Specific Website

S.Cantwell — Wed, 21 Oct 2020 12:36:12 GMT

Hello

Yes, I can understand your query now.

It is simple, and let me explain.

In previous versions, the Override was used an "Allow" or "Block", that was processed before the built in categories.

in 9.1.3, the functionality is the same. Look for creating two (2) Custom URL categories.

One will be (blocking) *.youtube.com

The other one will be for those site you want to allow:

*.googlevideo.com/videoplayback
www.youtube.com/embed
www.youtube.com/yts/jsbin/
www.youtube.com/yts/cssbin/
www.youtube.com/get_video_info?*.[your-company-domain].*

Be sure to look at the two attached pics on this thread/response.

Re: Need to Allow Video-Streaming from Specific Website

Jafar_Hussain — Wed, 21 Oct 2020 12:42:17 GMT

@S.Cantwell

Thank you for your reply.

Let me check this. i will confirm you it is working or not.

Re: Need to Allow Video-Streaming from Specific Website

Jafar_Hussain — Wed, 21 Oct 2020 13:50:37 GMT

@S.Cantwell

It means i need to create a policy like this:-

source one- inside

source address- any

destination zone - outside

destination address - any

application - any

service - any

action - allow

in security profile - need to create a URL filtering that is mention by you and all other URL category should be block. is this correct.?

Re: Need to Allow Video-Streaming from Specific Website

S.Cantwell — Wed, 21 Oct 2020 18:51:12 GMT

Yes, that could work fine.

Totally different comment here:

Question though... WHY such an open rule? Can you lock it down?

Can you make 2 security policies, to accomplish the same thing.

Traffic from SZone to DestZone (IP of tube), using youtube application on APPOVED_Youtube_URL, on application default?

Next rule.. deny ALL traffic to youtube?

Re: Need to Allow Video-Streaming from Specific Website

Jafar_Hussain — Tue, 27 Oct 2020 13:29:22 GMT

@S.Cantwell

The same i tried but not working.

custom URL cateogory:-

In URL filtering:- URL filtering name - (learning website video)

allowed (Approved_youtube) custom URL category and block (Block_youtube) custom URL category.

In policy:-

SZ- inside

S user- ANY

DZ- Outside

destination Address - Any

Application- ANY

Service- ANY

service/URL category- ANY

Action - Allow

profile setting - Apply only URL filtering profile learning website video.

but the issue still same. any other way , i can achive this ?

Re: Need to Allow Video-Streaming from Specific Website

S.Cantwell — Tue, 27 Oct 2020 13:39:04 GMT

Can you provide snippets of logs, screen captures, etc.

Just saying it is not working.. is not enough.

What happens when you try to connect? Error messages.

Your next steps is to take wireshark/packet captures to help you visualize what is happening on the wire, and you can configure your policies better.

TAC should be able to assist you as well.

Re: Need to Allow Video-Streaming from Specific Website

Jafar_Hussain — Wed, 28 Oct 2020 08:27:35 GMT

@S.Cantwell

I took the packet capture and below are my findings:-

1 - I can see in packet capture most of the packet 'ignore unknown record' when i check it is causing of L4 checksum. do i need to disable the L4 checksum?

2 - As well as i run the counter command and found TCP sessions closed via injecting RST. for this, i have allowed the challenge-ACK from the CLI.

3 - Below is the snapshot of the error while playing the video.

4 - Below is the snapshot of counter command:-

Re: Need to Allow Video-Streaming from Specific Website

Jafar_Hussain — Sun, 01 Nov 2020 13:15:37 GMT

@S.Cantwell

I have downgraded my firewall up to 8.1.0 and found the override option is available. but i tried the same configuraion according to document but issue still persists.

Re: Need to Allow Video-Streaming from Specific Website

S.Cantwell — Mon, 02 Nov 2020 19:55:10 GMT

@Jafar_Hussain

Sounds like you have to open a ticket with the TAC.

Good luck and let me know what you find.

Thx

Re: Need to Allow Video-Streaming from Specific Website

Jafar_Hussain — Wed, 04 Nov 2020 10:09:10 GMT

@S.Cantwell

Thanks for the reply.

I believe we can achieve this requirement by the decrypt you tube traffic.

I just want to confirm can we decrypt youtube traffic or not.

Because when i applied the decryption policy on youtube. youtube stop working it is showing the below error