rules to allow webinars while blocking http-audio and http-video

[hvcomputech]

We block most http-audio/video in our enterprise but we allow access to webcasts/webinars. We have had to resort to create a "webinar" rule allowing http-audio and video, rtmp, rtmpe, gotowebinar, and more... with specific IP ranges. Because these change often we have to keep adding CDN IPs to this rule for people to see/hear the webinars. This includes adding a flavor of default URL categories to match the rule.

Apart from playing whack-a-mole, the concern is that allowing those ranges with, say, the business-and-economy, content-delivery-networks or streaming-media rule will allow traffic matching that security policy rule for sites unrelated to online webinars or courses.

Is there a different/easier way to do this while still blocking http-video and audio for anything not related to webinars? Can someone share rules or ideas accomplishing this?

Thanks,

Larry

[bmorris1]

Hi Larry,

It might be easier to use User-ID for this purpose.

Have a 'webinar' user group and have a single rule for them instead of constantly modifying a security rules, you just need to add the people that need access to webinars into the webinar user group on your AD for them to have access. If they're not in the user group then they can match the default-deny rule.

You could combine this with a new feature in Windows Server 2016 which is 'timed group membership'.

hope this helps,

Ben

[BPry]

@hvcomputech,

@bmorris1 has a good idea here, if you aren't running server 2016 it at least makes it so that you only have to worry about one user-id group. If that doesn't work out you can automate this through the API, allowing you to quickly include someone in the webinar rule, and then have a scheduled API call that clears out said users sometime during non-business hours so that it they only have access for a limited amount of time. 

[OtakarKlier]

Another option is use fqdn instead of IP ranges.