block all video streaming with palo alto PA-850??

[Chivas]

Hello all,

I want to block all video treaming with palo alto. do do following this:

    1, go to Objects--> URL fitering--> add new URL fitering with name block_video.

    2, in categories, I check in streaming-media and choose block.

    3, I create the policy with full internet, and in action tab --> URL fitering --> Block_video.

But users can access video normally, Please help to advise.

thanks

[markus.wissgott]

what does your url filtering log shows for these sessions? which category and url? is there ssl decryption in place?

[Chivas]

Hi Marcus,

it don't show any logs in URL filtering log. There is SSL decryption in place. I just want to block streaming-media and allow to access any websites.

[markus.wissgott]

Are you sure, that you got a valid url filter licence on your PA?

If so, are you logging the sessions of that security rule, where your url filter policy is active?

[BPry]

@Chivas,

Generally speaking these policies are best effort; meaning that there are plenty of ways for users to bypass policies like this and they will need regular maintenance to continue to function as you intend as more services are brought online almost constantly. 

What I'll generally do is create a rule that is simply to deny access to a subset of app-ids. This will simply include an application group with the service set to application-default and the action of Deny. This will block the specified applications whenever they are identified.

Then I'll create a general browsing rule below the above policy. The only thing special with this security rule is the assigned URL Filtering Profile is going to have whatever category I'm using (whether its the default 'streaming-media' category or a custom 'video-blocking' category) set to block. 

With this setup the users will encounter an application block page whenever they get identified as using a blocked app-id, and the URL Filtering page when they navigate to something like plex.tv that the firewall identifes the URL before it identifies the app-id. 

It would be helpful if you included a screenshot of how your policy is configured, there may be a simple mis-configuration.