I want to block all video treaming with palo alto. do do following this:
1, go to Objects--> URL fitering--> add new URL fitering with name block_video.
2, in categories, I check in streaming-media and choose block.
3, I create the policy with full internet, and in action tab --> URL fitering --> Block_video.
But users can access video normally, Please help to advise.
Generally speaking these policies are best effort; meaning that there are plenty of ways for users to bypass policies like this and they will need regular maintenance to continue to function as you intend as more services are brought online almost constantly.
What I'll generally do is create a rule that is simply to deny access to a subset of app-ids. This will simply include an application group with the service set to application-default and the action of Deny. This will block the specified applications whenever they are identified.
Then I'll create a general browsing rule below the above policy. The only thing special with this security rule is the assigned URL Filtering Profile is going to have whatever category I'm using (whether its the default 'streaming-media' category or a custom 'video-blocking' category) set to block.
With this setup the users will encounter an application block page whenever they get identified as using a blocked app-id, and the URL Filtering page when they navigate to something like plex.tv that the firewall identifes the URL before it identifies the app-id.
It would be helpful if you included a screenshot of how your policy is configured, there may be a simple mis-configuration.
You can do a best effort and simply leave the URL side of things out at that point then. The one thing to take note of here as @markus.wissgott mentions is that this is going to be exactly that best effort. The firewall will likely pass a few packets before it's able to identify the streaming traffic, so streams will first appear like they were and then break.
Other times you'll likely never see any app-id that would indicate streaming anything, so the firewall will simply allow the traffic across certain sites until/unless it properly identfies things.
Just in general I would say this is kind of a terrible idea if you aren't going to go full hog with it.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!