Skype-Probe sessions increase dramtically when blocking skype

[migration]

Hi All,

Seem to be having a bit of a problem with skype-probe.

I have a PA-500 in Vwire mode behind a PIX FW, the customer wishes to block Skype traffic.

Observations:

1.     On the ACC the ammount of skype-probe traffic far exceedes any other traffic in terms of sessions

2.     The ammount of bytes of skype-probe traffic is roughly in relation to the amount of skype bytes

3.     When enabling a skype only block rule (still allowing skype-probe) the active session count sky rockets

The sessions that increase dramatically are from skype-probe these sessions go from a current 4,000 sessions to 50,000+ in a matter of under a minute until the skype block rule is disabled.

Any help and insight will be greatly appreciated

Cheers

Marc

attached is screen shots of skype-probe session count for last hour

[dwhyte]

Please reference the "Controlling Skype" document in knowledge point from the support.paloaltonetworks.com support portal. 

[KGC]

My understanding is that you need to allow skype-probe traffic through to establish a connection, and then block the actual skype traffic once the Skype client believes it has connected. This prevents Skype from going evasive, but it does create a confusing situation on the client where it appears to be connected successfully, yet calling does not actually work.

[migration]

skype-robe is allowed in a rule.

The rule set look like this:

Source Zone	Dest Zone	Source	Dest	Source User	Application	Service	Action
Trust	Untrust	any	any	any	skype	any	deny
Trust	Untrust	any	any	Known Users	Various Apps (Incl skype-probe)	any	allow

Before skype is disabled the session count for skype-proble is high, as soon as you deny skype on the PA the skype-probe sessions go through the roof, as said earlier from about 4k sessions to 40k sessions in seconds.

[reaper]

try setting the allow skype-probe rule before the block skype rule, this may help decrease the number of probe connections

[migration]

will give it a go and provide feedback once done.

Regards

Marc

[migration]

Hi,

With a skype-probe allow rule above the skype block rule, we still experience the same volume of sessions

Marc