Skype blocking

[markk96]

I have found in testing that with blocking, the application 'skype' and 'skype-probe' if the user is not logged in the policy will block the user from signing into skype, but if the user is already signed into skype and plugs in behind the palo policy, the traffic log shows skype being blocked, but the user is still able to IM.  Am I missing something?

[ssharma]

Hi Markk96,

Make sure you have enabled "Rematch Sessions" under Device -> Setup -> Session and commit. Test again and see if you get similar results. Thank you.

[markk96]

Rematch Sessions is already checked.  Anything else to check?

[bat]

Hi markk96

As per this article: How to Block SKYPE you should not block skype-probe: "Skype-probe needs to be allowed. Skype-probe runs over port 80 and is used to setup initial connections. When Skype-probe is blocked, the application will encrypt the communication and start using alternate open ports which is why it needs to be allowed."

Have you already tried that ?

[bat]

Please also go through this document: Skype is not Blocked for Computers Entering Network with Skype Already Signed In

[markk96]

I removed skype-probe, i added msn-base, but still it is working, i guess when I get in the lab i will test this out further with unknown tcp and udp.

[bat]

Thanks for the update, do let us know how it goes

[markk96]

I have tried, blocking skype, msn base, unknown tcp and udp, but chat still works, even tho skype looks like it is spinning, I am able to send and receive IMs.

[hshah]

HI Mark,

What application does firewall identify for chap? It would be great if you can provide us output for "show session id <>"

Regards,

Hardik Shah

[markk96]

It looks like now it is going out on Insufficent-data.  Not sure how to block that other then the tcp port.

[hshah]

Hi Mark,

In-sufficient data means firewall has not yet identified application. Firewall needs more packets for identification.

Firewall should detect application in some time.

Regards,

Hardik Shah

[bat]

Have you tried changing the service from "application-default" to "any" for those security rules ?

[markk96]

I just changed it an no difference, uknown tcp was on port 37777 but now it is blocked and now it is insufficent data on port 37777, if i block the port, it just uses a different one.

[bat]

markk96 I see you have mentioned earlier that you removed "skype-probe" so is it not mentioned in any of the security rules ?

skype-probe should be allowed in one of the security rules for it to work as mentioned in the document.

[markk96]

Skype-Probe is allowed via another policy rule.