Blocking Torrent/P2P Connections using app ID.

[S.Jayathunge]

Hi Palo Alto Community,

I hope everyone’s having a great day! We’re working to enhance our network’s security by blocking torrent and other risky P2P communications. I’ve set up a deny policy using the “bittorrent” and “bittorrent‑sync” App‑IDs, but I noticed these require the “web‑browsing” App‑ID to function. When I include “web‑browsing” in the policy and commit it, web browsing traffic gets blocked for users—clearly not what we want.

I’d really appreciate any insights on:

1. How can I configure the policy so that “bittorrent” and “bittorrent‑sync” are blocked without impacting legitimate web browsing?
2. Is it possible for “bittorrent” and “bittorrent‑sync” App‑IDs to work independently—without their “web‑browsing” dependency?
3. Are there additional recommended App‑IDs to include when blocking P2P, malicious, or illegal traffic more comprehensively?

Thanks in advance for your advice.

[BPry]

@S.Jayathunge,

You would only want to have the two app-ids that you are looking to block [ bittorrent bittorrent-sync ] and you don't include web-browsing in the deny rule. You generally don't want to include any depends-on listing in a deny rule, you would only want to include them if you're attempting to permit the traffic if they aren't otherwise accounted for.

I would recommend reviewing your URL categories that you are allowing and think about creating an application or just application groups that you attempt to maintain for blocking access to certain applications. 

As an example, we have a list of applications that we deny externally for remote access applications (IE: Chrome Remote Desktop, Teamviewer, RDP, etc.) that we wouldn't want to allow externally. You might create an application-filter for encrypted network tunnels as another example excluding things like SSL that you wouldn't want to necessarily block.

You just want to be careful and actually validate any dynamic filters that you look at configuring. While you likely want to utilize application filters and URL categorization so you don't need to constantly update your list, you also want to be at least a bit conservative in rolling it out. That way you aren't suddenly blocking access to something legitimate that you haven't thought about.