URL Filtering - Blocks msn live and yahoo messenger

[eugene]

Hi All,

I wonder if anyone is facing this issue... If you enable web-based-email inside ssl decryption rules, it will also block user to access both msn live messenger and yahoo messenger (this does not happen to skype of course). Even though, the existing security rules stated allow any application without any filtering mode, this will still happen.

Pan-os: 3.0.5

application version: 163-489

threat version: 163-489

url filtering version: 3247

Any workaround?

Thanks.

[nrice]

Eugene,

If you've determined that your Yahoo and MSN IM sessions are being blocked by the filter on Web-based-email, Support recommends that you allow login.yahoo.com and live.msn.com.

[eugene]

Hi Nrice,

Thanks for your replied.

Nope, that is url filtering part, but the issue that i'm facing is with ssl decryption. Like i said, if you enable "web-based-email" category inside ssl decryption". I also tried using your method is the same.

In this case, how can we overcome this issue? As per now, there is no setting / configuration for us to whitelisting certain url as per ssl decryption category.

[nrice]

I ran this past Support and they recommend openeing a case so that they can work with you to get around the SSL decryption issue .

[jochristian]

Did you find a fix for this problem?
I'm having the same problem with 4.1.5 and ssl decryption. Can't login to msn.

Jo Christian

[jochristian]

So I found a fix for this problem.

Make a custom url category with *.msn.com and add it to a "no-decrypt" rule.

Jo Christian

[mikand]

To me that sounds bad because now all s**t at *.msn.com will bypass the protections that your PA can offer regarding threat and antivirus etc.

[jochristian]

Hello,

Yes I agree.

But I needed to find a fast fix and this was the solution.

I guess it is possible to tighten the url filter a bit by finding the correct somethingat.msn.com

But this will not be a perfect solution anyway.

Jo Christian