Controlling Skype using App-ID

by vsathiamoo ‎03-28-2017 12:49 AM - edited ‎08-14-2017 02:43 PM (8,098 Views)

What is Skype?

 

Skype is best known as a peer-to-peer IP telephony application developed by Niklas Zennstrm and Janus Friis, also founders of the file sharing application Kazaa and the new peer-to-peer television application Joost.  Skype compliments and competes directly with existing phone services, from traditional POTS to VoIP services. Its major strengths include the ability to provide connectivity through firewalls and NAT (network address translation), support for a large number of active users, and privacy protection via the use of strong encryption. Moreover, it supports integrated instant messaging (IM), chat, file transfer, video conferencing, and a global directory.

 

Skype's underlying technology leverages a distributed peer-to-peer architecture to route multimedia packets among the users as opposed to centralized servers. The peer-to-peer network offers increased connectivity and scalability, and also provides firewall traversal and dynamic routing to evade corporate firewalls.  Despite the fact that it's a closed-source application based on proprietary protocols, The proprietary and evasive behavior of Skype indeed poses a security challenge to enterprise networks, particularly given its ability to transfer files and information without visibility or control.

More about Skype can be found here - https://www.skype.com/en/about/

 

To Allow Skype in your network, the following App-IDs have to be white listed on your Palo Alto Networks firewall:

 

  • office365-consumer-access
  • rtcp
  • rtp
  • skype
  • skype-probe
  • ssl
  • websocket
  • stun
  • web-browsing
  • windows-azure-base
  • apple-push-notifications

 

Create security policies under Policies > Security as illustrated in the screenshot below to allow Skype to function.

 

Screen Shot 2017-03-27 at 10.34.47 AM.png

 

Skype For Business:

 

At a minimum, the following App-ID has to be whitelisted for Skype For Business to function properly. 

 

  • Ms-lync-base (matches the core functionality of the application)
  • ms-lync-online
  • rtcp
  • stun (for media negotiation)
  • rtp (for media streaming)
  • ms-office365-base (core functionality of O365 applications)
  • ssl
  • web-browsing
  • ms-lync-audio/video

 

Some of the standalone clients have pinned certificates. Skype For Business should also be excluded from decryption (you can use SSL decryption exclusion from Device > Certificate Management) and add *.online.lync.com and *.infra.lync.com to exclusion list.

 

Screen Shot 2017-08-14 at 2.43.10 PM.png

 

 

 

Comments
by AlexandrTG
3 weeks ago

Does any one add URL category ? If we use this rule, then anyone able to surf internet freely. Too broad.

Ask Questions Get Answers Join the Live Community