blocking file-sharing subcategory

[KenKruger]

I would like to block everything in the file-sharing subcategory of the general-internet category. Currently we are allowing this subcategory.

I would like to see what the impact of a policy like this would be, so I setup a policy for this subcategory but set it to allow so I can look at the traffic log for everything that triggers on this rule. I am seeing a lot of traffic hit this policy probably because I had to add so many applications to the rule (like web-browsing & ssl) so that the packets can be broken down further.

Is there a recommended way to block this traffic?

[rmonvon]

Hi...You can run a report on your network to see what apps would match the subcategory.  This will give you an idea of the policy you want to enforce.  The report setting can be:

timeframe: last 7 days

database: Application Statistics

filter:  (subcategory-of-name eq file-sharing)

Typically, most enterprises would block file-sharings that are peer-2-peer like bittorrent & gnutella.  May we suggest that you start with that.  Thanks.

[KenKruger]

I ran a report on sub-category of file-sharing and it shows me that bittorrent (for example) is being used. Now how do I find out who is using bittorrent?

[mikand]

If you have userid configured you should see a username aswell, otherwise at least the srcip.

You can use the same rule in ACC to get this data (dont forget to change timeline otherwise you will watch just last hour or such).