block all video streaming with palo alto PA-850??

[Chivas]

Hello all,

I want to block all video treaming with palo alto. do do following this:

    1, go to Objects--> URL fitering--> add new URL fitering with name block_video.

    2, in categories, I check in streaming-media and choose block.

    3, I create the policy with full internet, and in action tab --> URL fitering --> Block_video.

But users can access video normally, Please help to advise.

thanks

[markus.wissgott]

what does your url filtering log shows for these sessions? which category and url? is there ssl decryption in place?

[Chivas]

Hi Marcus,

it don't show any logs in URL filtering log. There is SSL decryption in place. I just want to block streaming-media and allow to access any websites.

[markus.wissgott]

Are you sure, that you got a valid url filter licence on your PA?

If so, are you logging the sessions of that security rule, where your url filter policy is active?

[BPry]

@Chivas,

Generally speaking these policies are best effort; meaning that there are plenty of ways for users to bypass policies like this and they will need regular maintenance to continue to function as you intend as more services are brought online almost constantly. 

What I'll generally do is create a rule that is simply to deny access to a subset of app-ids. This will simply include an application group with the service set to application-default and the action of Deny. This will block the specified applications whenever they are identified.

Then I'll create a general browsing rule below the above policy. The only thing special with this security rule is the assigned URL Filtering Profile is going to have whatever category I'm using (whether its the default 'streaming-media' category or a custom 'video-blocking' category) set to block. 

With this setup the users will encounter an application block page whenever they get identified as using a blocked app-id, and the URL Filtering page when they navigate to something like plex.tv that the firewall identifes the URL before it identifies the app-id. 

It would be helpful if you included a screenshot of how your policy is configured, there may be a simple mis-configuration. 

[Chivas]

Hi Bpry,

I understood wrong about streaming-media.

I just want to block the video, not block URL. example, when users access to abc.com, they can view content, just cannot play video.

thanks

[markus.wissgott]

okay, this will be hard, likly impossible as i can see. can you tell me why you want to do that?

[BPry]

@Chivas,

You can do a best effort and simply leave the URL side of things out at that point then. The one thing to take note of here as @markus.wissgott mentions is that this is going to be exactly that best effort. The firewall will likely pass a few packets before it's able to identify the streaming traffic, so streams will first appear like they were and then break. 

Other times you'll likely never see any app-id that would indicate streaming anything, so the firewall will simply allow the traffic across certain sites until/unless it properly identfies things. 

Just in general I would say this is kind of a terrible idea if you aren't going to go full hog with it.