URL Content filtering Question - Netflix

[migration]

Ok, don't shoot the messenger but I was asked to see if I could unblock the queue management area for Netflix but still block the streaming media part of it...  We're using the URL filtering capabilities of the PA 2050 device and I have a policy defined that's based on an Active Directory user group to filter traffic.  I'm not sure how I would go about doing this, any thoughs?

[pkruse]

Have you considered allowing the URL but blocking the App?

I created a policy that allows the URL but blocks the "netflix" application and I am able to managem my queue but not watch streaming video's from the site.

[migration]

That sounds very promising, you wouldn't happen to have some specifics on how to do this would you?

[pkruse · Accepted solution]

Its pretty basic, your going to create a rule that precedes your URL filtering rule. The rule will be from trust to untrust application will be "netflix" and action will be drop.

[migration]

That worked perfectly, the queue management stuff works while the streaming part just dies.  Thanks for the help!

[cshep]

Has Palo Alto changed the Netflix signature recently?  In September we had blocked the application per Phil's suggestion earlier in this thread and people were able to login and manage their queue but couldn't view any movies.  This morning, though, I wasn't able to login anymore. Thanks --

[bpappas]

@cshep: you would have to review all of the release notes to see what has changed between each version of the content update to see if PAN engineering have updated any particular application signature(s).

A key question that should help you find the cause of your issue:

What log is showing Netflix browsing as "deny" or "block"?

If you see the block in either the "traffic" or "threat" logs then that would be due to either an application update or an antivirus update. If you see the block in the URL filtering log then it is your URL filtering profiles that need examination.

-benjamin

[migration]

I would say looking at the logs should give you an indication of whats going on with the block.  I have a handful or preset filters for looking at that kind of thing.  I'm running 3.1.4 code with the latest app and threat updates and have just noticed I'm unable to get to the netflix.com queue.  I can get to the sites front page however loggin in doesn't happen.  When I look at the traffic log is see a deny for netflix based on the app, i don't see anything blocked in the URL log for netflix so it's definately the app.  I'd have to look back as well but I'm guessing a app and threat update changed something.

[JeffTQT]

Anyone found a solution for this? I am on 4.0.7 code and have been asked to do the same thing. I can either block the whole site or none of it.

[bpappas]

Based upon my research there have been no recent updates to the Netflix application ID in our content updates.

If you require assistance resolving this issue I would suggest posting some screen shots of the traffic, URL filtering and threat logs to this thread so that we can do some detective work and find the root cause of the issue.

Thanks,

Benjamin