The Mysterious "stun" application

[s.williams1]

Does anyone have a understandable explaination of this application called "stun" from what I can gather its used for things like skype and facetime, but it generates a lot of traffic in my network. While yes we are lync/skype in house and there are the occosional calls out to the internet, I see this application going out to google public IPs on port 19305 and 19302, I see ports 5055 being used as well. How do you control this application?

[BPry]

@s.williams1,

Applipedia will help you out here a lot. 

"Simple Traversal of User Datagram Protocol is a network protocol allowing a client behind a NAT (or multiple NATs) to find out its public address."

You'll see stun utilized a lot for different applications and such as it is currently the best way of determining the clients public IP address and detecting whether or not it is behind a NAT or not. SIP, WebRTC and others rely on it pretty heavily. If you are running Skype internally you should be seeing a TON of Stun traffic, iPhones will generate a bit as well because of FaceTime, and depending on the applications on the device you can expect a lot to come from Android devics as well. 

Stun by itself really isn't dangerous so there really isn't much control to be done, at least to my eyes. Allow it outside your network on application default ports and if your Skype infrastructure is generating too many logs in your eyes setup a security rule to simply not log traffic going to your Skype servers. 

[s.williams1]

So I have a rule to allow stun applicaiton on application default service ports but i see it hitting my allow all at the end of the list on different ports. So should I allow "any" on the service ports section?

[BPry]

@s.williams1,

Kind of up to you at that point. Where exactly are you seeing the 'stun' traffic, from Trust to Untrust? I would first start to look at the logs and see if you can narrow this down to a more specific source or destination rule. 

[Matt-Mercer]

Palo Alto doesn't do that great of a job identifying traffic unless you are running a cert store and issuing a cert to every device on your network.  We in education see STUN used mostly for MS Teams and Facetime in which Palo Alto has app identifiers for but since we don't run a cert store, all traffic can't be fully decrypted and identified properly by app id.  A better suggestion might be to setup a QOS with low real-time bandwidth and create a QOS rule for STUN to use that low bandwidth and see who screams and then find out what they are doing and see if it is allowed traffic or not.  Most of the time you will find it is all personal and not business related unless you rely heavily on VOIP apps like Skype, MS Teams, WebEx, SIP phones, etc.