Need to Allow Video-Streaming from Specific Website

[Jafar_Hussain]

Hello Dears,

 Requirement:- I want to allow only some educational videos (educational videos belong from training and tools URL category) for my environment.

Below i have tried:-

• I have checked all the streaming videos played on YouTube or any the streaming media category.
• When we allow traffic for training and tools as well as streaming media category the website working fine.
• But according to my requirement only learning video should be play rest should be block.
• I have tried to achive my requirement by the below documents:-
• https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClikCAC
• According to the documents to achieve my requirement there is one option “Overrides” in URL filtering. But unfortunately this option is not available in latest PAN-OS (“Override” option was available on previous version). my PAN OS is 9.1.3

Could you please suggest is there any other way to achive my requirement.

Thanks.

[SteveCantwell]

Hello

Yes, I can understand your query now.

It is simple, and let me explain.

In previous versions, the Override was used an "Allow" or "Block", that was processed before the built in categories.

in 9.1.3, the functionality is the same.  Look for creating two (2) Custom URL categories.

One will be (blocking) *.youtube.com

The other one will be for those site you want to allow:

• *.googlevideo.com/videoplayback
• www.youtube.com/embed
• www.youtube.com/yts/jsbin/
• www.youtube.com/yts/cssbin/
• www.youtube.com/get_video_info?*.[your-company-domain].*

Be sure to look at the two attached pics on this thread/response.

[Jafar_Hussain]

@SteveCantwell 

Thank you for your reply.

Let me check this. i will confirm you it is working or not.

[Jafar_Hussain]

@SteveCantwell 

It means i need to create a policy like this:-

source one- inside

source address- any

destination zone - outside

destination address - any

application - any

service - any

action - allow

in security profile - need to create a URL filtering that is mention by you and all other URL category should be block.  is this correct.?

[SteveCantwell]

Yes, that could work fine.

Totally different comment here:

Question though... WHY such an open rule?  Can you lock it down?

Can you make 2 security policies, to accomplish the same thing.

Traffic from SZone to DestZone (IP of tube), using youtube application on APPOVED_Youtube_URL, on application default?

Next rule.. deny ALL traffic to youtube?