Skype is not working with allow rule

[MohamedSharief]

Hi,

We have a demand to allow skype for internal employees. However, we've created a security rule to allow the following applications:

-skype

-skype-probe

-ssl/web-browsing

Still skype couldn't connect with an error message "please check your internet connection and try again".

So I've added *.skype.com/* in the URL filteration > still doesn't work

Also I tried to user web-browsing instead of ssl > still doesn't work

and finally I've added both ssl & web-browsing > still doesn't work

When I checked the traffic log I found the following:

Session end reason: tcp-rst-from-client & tcp-fin & n/a

Does anyone know exactly whats going on here?

[MohamedSharief]

1-      Appliance Model: PA-500

2-      PAN-OS version: 7.1.3

3-      Applications Version: 599-3443

[BPry]

What rule is the traffic actually hitting as it stands, and where is the allow rule in corelation within your lists of security policies? It sounds like you are hitting a pretty strict deny rule, as if this was a consumer version of Skype then it will fall back to port 80/443.  

[MohamedSharief]

Traffic is hitting the same rule created for Skype as mentioned in traffic log. The rule I've created is located in the top of the policies.

The weird thing is skype is not even allowing me to enter a username and password, the front page of skype never displayed, it will just start loading then "check your internet connection" will pops up.

[santonic]

Can you please check if you have denied unknown-udp sessions dropped on high UDP ports towards Microsoft public IP addresses?

I have found a situation where skype and skype-probe is allowed with application rule, TCP 443 is allowed as service (in seperate rule ofc) and Skype still isn't working. I've noticed connection towards Microsoft IP addresses on high UDP ports 'recognised' as unknown-udp and of course dropped. Skype should be working without having to allow unknown-udp session.

Anyone else has similar problems with Skype?

[MohamedSharief]

I've already thought about adding unknown-udp to the policy and infomred the client to made the changes. Waiting his reply now.

[MohamedSharief]

Aaaaaand its still not working. Even when we added the unknown-udp to the policy.

In the traffic log I noticed when the type is "end" the session end reason is either "tcp-rst-from-client" or "tcp-fin" but when the type is start the session end reason is always n/a.

[BPry]

I would test with a single source IP address allocated an 'any any' rule without any blocks in place and see if you still recieve the error. That would at the very least tell you if it's actually a rule issue. If that works I would request a config export since it seems like you are working with someone offsite and don't have direct access to the equipment. 

[MohamedSharief]

Great idea BPry. I'll make sure to implement that tomorrow. Thanks

[MohamedSharief]

I've created "any to any" policy where the source address is the engineer's laptop, then added skype, skype-probe and unkown-udb to the list of applications and committed the changes. This time I got a warning that to enable skype I must add msn-base, ssl and web-browsing. I committed without adding those then tried but failed, then I added apps in warning but still doesn't work. When I checked the logs again I got on start session n/a as session end reason and on end session tcp-rst-from-client & tcp-fin as session end reasons.

Any idea on whats going on guys?

[LCMember1959]

Have you tried the same rule, but with Any/Any as application and service? If Skype still does not work then I would suspect that it might be a client problem.

[MohamedSharief]

I will try that Terje.

When I added the policy "any any" today and commit the changes I got a warning that msn-base, ssl and web-browsing should be allowed as dependency apps also, but when I checked in https://applipedia.paloaltonetworks.com/ its not required. To double check this I shoot the command #show predefined application skype and those dependency apps were included. But again I've already tried and added them and still doesn't work.

[BPry]

I guess what I meant as an 'any any' rule was that it would be any destination and any applicaiton. This placed above all other security rules will let you know if this is a firewall issue or a network issue. If you still can't get to Skype with a set source address, any destination, and any application set to allow then it would indicate that your firewall isn't at fault here; something in front of your firewall is to blame for the issue. 

[RFalconer]

Anything in the threat log that shows traffic being blocked?

[Indorama_Ventures]

Is nothing working with Skype or just for example video conversation?

I had the problem lately that chat and audio were working but video wasn't.

It turned out I was missing the "Jabber" application in the allow rule.