Skype blocking

Reply
L3 Networker

Skype blocking

I have found in testing that with blocking, the application 'skype' and 'skype-probe' if the user is not logged in the policy will block the user from signing into skype, but if the user is already signed into skype and plugs in behind the palo policy, the traffic log shows skype being blocked, but the user is still able to IM.  Am I missing something?

L5 Sessionator

Re: Skype blocking

Hi Markk96,

Make sure you have enabled "Rematch Sessions" under Device -> Setup -> Session and commit. Test again and see if you get similar results. Thank you.

L3 Networker

Re: Skype blocking

Rematch Sessions is already checked.  Anything else to check?

Highlighted
bat
L5 Sessionator

Re: Skype blocking

Hi markk96

As per this article: How to Block SKYPE you should not block skype-probe: "Skype-probe needs to be allowed. Skype-probe runs over port 80 and is used to setup initial connections. When Skype-probe is blocked, the application will encrypt the communication and start using alternate open ports which is why it needs to be allowed."

Have you already tried that ?

bat
L5 Sessionator

Re: Skype blocking

L3 Networker

Re: Skype blocking

I removed skype-probe, i added msn-base, but still it is working, i guess when I get in the lab i will test this out further with unknown tcp and udp.

bat
L5 Sessionator

Re: Skype blocking

Thanks for the update, do let us know how it goes :smileyhappy:

L3 Networker

Re: Skype blocking

I have tried, blocking skype, msn base, unknown tcp and udp, but chat still works, even tho skype looks like it is spinning, I am able to send and receive IMs.

L6 Presenter

Re: Skype blocking

HI Mark,

What application does firewall identify for chap? It would be great if you can provide us output for "show session id <>"

Regards,

Hardik Shah

L3 Networker

Re: Skype blocking

It looks like now it is going out on Insufficent-data.  Not sure how to block that other then the tcp port.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!