How to Block Skype

Details

To block Skype, Skype-probe needs to be allowed. Skype-probe runs over port 80 and is sets up initial connections. When Skype-probe is blocked, the application encrypts the communication and starts alternate open ports, which is why it needs to be allowed.

Steps

The following procedure blocks Skype traffic on the Palo Alto Networks firewall:

1. From the Web UI, go to Policies > Security and click the Add icon in the lower left:
   
2. Select Application tab and set the application to "Skype-probe."
   The source should be any applicable internal zones.
3. Set destination to any.
4. Set action to allow.
   
5. Create a similar second rule but with the following changes:
6. Select "Skype" as the application.
7. Set the action to block.
   
8. Commit your changes.

owner: panagent