Skype IM Problem

Reply
Highlighted
L3 Networker

Skype IM Problem

Hi,

I've some problems with skype instant messaging.

Sometimes the messages are not sent.

Checking firewall logs I see when messages are not sent an 'unknown-tcp' connection is denied.

Same destination port (but different ip) were used and recognized before as 'skype' connection

For example

Time            App         From        Src Port   Source
Rule            Action      To          Dst Port   Destination
                Src User    Dst User

===============================================================================

2012/11/06 11:19:26 skype       Zone1      52682 192.168.xxx.xxx
Skype           allow       Zone212350 78.141.179.16
                user1

2012/11/06 11:19:56 unknown-tcp Zone1  49727 192.168.xxx.xxx
blocca_navigazione  deny        Zone2   12350 78.141.179.12
                user1

It seems that PAN-OS was not able to identify correctly the connection.

For security reasons I cannot open 'unknown-tcp' connection.

Any solutions?

Firewall PAN-500

OS: 4.1.7

Application and threat:  336-1565 2012-10-30

Thanks

Regards


Accepted Solutions
Highlighted
L3 Networker

Re: Skype IM Problem

Hi,

after I allowed "skype", "skype-probe", "unknown-tcp" and "unknown-udp" from "test-user" to any (any ports) everything works fine.

I see "unknow-tcp" traffic so problem is that some skype packets are not correctly recognized.

I will open a support case

View solution in original post


All Replies
Highlighted
L6 Presenter

Re: Skype IM Problem

I wonder if the dependency fixes in PANOS 5.0 would help you or not.

I mean this way only enough traffic to identify what you have set to allow will be able to pass through.

In this particular case this would hopefully mean that "unknown-tcp" would be allowed for x packets going from this particular client towards wathever ip/port the signature for skype in appid uses (compared to today where you basically must allow "unknown-tcp" statically with srcip:any dstip:any unless you want stuff like this to be blocked).

By the way, did you already enable skype-probe?

Highlighted
L3 Networker

Re: Skype IM Problem

Hi,

skype-probe is enable.

Now I'm testing a new rule for this user.

I'm allowing "skype", "skype-probe", "unknown-tcp" and "unknown-udp" from "test-user" to any (any ports).

Probably it will works but problem is that I want keep blocked "unknown-tcp" from any to any...

Do you know if PAN OS 5.0 will solve this problem? When will the new version?

Thanks

Regards

Highlighted
L4 Transporter

Re: Skype IM Problem

Hi Mauro,

If you still see Skype traffic being classified incorrectly I would suggest opening a support case so we can investigate.  We will likely need a client PCAP and the show session output showing the problem sessions but we should be able to add it to the application.

Thanks,

-- Kevin

Highlighted
L3 Networker

Re: Skype IM Problem

Hi,

after I allowed "skype", "skype-probe", "unknown-tcp" and "unknown-udp" from "test-user" to any (any ports) everything works fine.

I see "unknow-tcp" traffic so problem is that some skype packets are not correctly recognized.

I will open a support case

View solution in original post

Highlighted
L4 Transporter

Re: Skype IM Problem

Also keep in my mind that Skype is one the of the most tricky and hiding application and it changes often. The fact it's seen as unknown-tcp is not surprise and can't blame PAN for this.

Skype should document their product and stop playing cat and mouse game if they don't want to be purely blocked in all big corp networks.

Highlighted
L3 Networker

Re: Skype IM Problem

I know Skype changes very often and I understand that it shouldn't be simple for PAN.

I think problem is that sometimes destination IP changes.

I paste again my above example:

Time            App         From        Src Port   Source
Rule            Action      To          Dst Port   Destination
                Src User    Dst User

===============================================================================

2012/11/06 11:19:26 skype       Zone1      52682 192.168.xxx.xxx
Skype           allow       Zone212350 78.141.179.16
                user1

2012/11/06 11:19:56 unknown-tcp Zone1  49727 192.168.xxx.xxx
blocca_navigazione  deny        Zone2   12350 78.141.179.12
                user1

As you can see in the first line the IP was 78.141.179.16 (destination port 12350 ) while in the second line IP was 78.141.179.12 (same destination port)...

By the way...

Yesterday PAN sent

Application and Threat Content Release Notes

  Version 337

Modified Applications (7)

Risk

Name

Category

Subcategory

Technology

Depends on

Minimum Version

4

flash

general-internet

internet-utility

browser-based

web-browsing

  1. 3.1.0

3

hotspot-shield

networking

encrypted-tunnel

client-server

ssl,web-browsing

  1. 3.1.0

5

nntp

general-internet

internet-utility

client-server

  1. 3.1.0

1

pcoip

networking

remote-access

client-server

  1. 3.1.0

2

securid

business-systems

auth-service

client-server

  1. 3.1.0

4

skydrive(function)

general-internet

file-sharing

browser-based

live-mesh,ssl,web-browsing

  1. 3.0.0

5

skype

collaboration

voip-video

peer-to-peer

web-browsing

  1. 3.1.0

Skype application changed.

Do you know if PAN solved this problem?

Thanks

Regards

Highlighted
L4 Transporter

Re: Skype IM Problem

IPs will change all time : Skype is not a centralized system , a client (you for example) can become a proxy for other clients, like a peer to peer program. Same when you chat / video call, it's a peer to peer communication.

Also you can revert to the old signature package and see if it solves your problems.

Highlighted
L3 Networker

Re: Skype IM Problem

So you think this cannot be the problem, don't you?

Highlighted
L4 Transporter

Re: Skype IM Problem

That's my opinion: Destination IP and ports cannot be the problem as Skype is peer to peer enabled it doesn't rely on a pre-known list of servers.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!