Block YouTube--Allow Google.com

[kuntzelectroplating]

We have 1 user who is abusing Youtube. I need to block this person from YouTube but still allow this person access to google.com

I tried a URL filtering policy but it also blocked access to google.com.

Is there a document or a video of how to perform this task?

I am running PAN OS 7.1

Thank you

[Brandon_Wertz]

Why not just use application controls?

I'm gonna venture a guess that trying to accomplish this via URLs is going to be an untenable solution.

[BPry]

How did you block it in the URL filtering? 

If you make a custom URL Filtering for this user and list *.youtube.com and youtube.com in the block-list and set the action to block then you should be perfectly fine by just listing the URLs and it shouldn't block Google. You would just need to make a special rule for your special user. 

Really though this is trully an issue for your HR department; sometimes companies try to solve HR issues with Tech and it never works out. 

[kuntzelectroplating]

Thank you for your reply.

I first tried to use an application-id, but I was still able to access youtube.com.

Then I tried a URL filter with the domain names you suggested. It blocked youtube but also google.

Google and youtube are so closely tied together now, it is hard to separate them. It looks like (from the logs) that when you go to youtube you are redirected to googlevideo.com.

I couldn't agrre more about the HR issue.

[Brandon_Wertz]

@kuntzelectroplating

I tried just using the "container" YouTube and was able to access it as well.  Then I created a rule that used all the sub-applications and I was denied from viewing the actual videos.  This should suffice for your policy request.  

I'm running 5060s on 7.0.X with SSL Interception.

--EDIT--  

I just created a simple rule that targeted my user ID only to anything out on the Internet using the 4 "YouTube" applications.  On application default settings with a "Deny" action and achieved the result below.

Application version

638-3696 (11/21/16)

[kuntzelectroplating]

Did you deploy a security rule using application-id's or URL filtering?

[Brandon_Wertz]

0 URL filtering controls.  (I've since deleted the rule from my environment so I can't show you.)

[Brandon_Wertz · Accepted solution]

[kuntzelectroplating]

Thanks...I will give that a try.