rules to allow webinars while blocking http-audio and http-video

Showing results for 
Search instead for 
Did you mean: 

rules to allow webinars while blocking http-audio and http-video

L3 Networker

We block most http-audio/video in our enterprise but we allow access to webcasts/webinars. We have had to resort to create a "webinar" rule allowing http-audio and video, rtmp, rtmpe, gotowebinar, and more... with specific IP ranges. Because these change often we have to keep adding CDN IPs to this rule for people to see/hear the webinars. This includes adding a flavor of default URL categories to match the rule.


Apart from playing whack-a-mole, the concern is that allowing those ranges with, say, the business-and-economy, content-delivery-networks or streaming-media rule will allow traffic matching that security policy rule for sites unrelated to online webinars or courses.


Is there a different/easier way to do this while still blocking http-video and audio for anything not related to webinars? Can someone share rules or ideas accomplishing this?






L4 Transporter

Hi Larry,


It might be easier to use User-ID for this purpose.


Have a 'webinar' user group and have a single rule for them instead of constantly modifying a security rules, you just need to add the people that need access to webinars into the webinar user group on your AD for them to have access. If they're not in the user group then they can match the default-deny rule.


You could combine this with a new feature in Windows Server 2016 which is 'timed group membership'.


hope this helps,



@bmorris1 has a good idea here, if you aren't running server 2016 it at least makes it so that you only have to worry about one user-id group. If that doesn't work out you can automate this through the API, allowing you to quickly include someone in the webinar rule, and then have a scheduled API call that clears out said users sometime during non-business hours so that it they only have access for a limited amount of time. 

Cyber Elite
Cyber Elite

Another option is use fqdn instead of IP ranges.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!