youtube detection failure

[Ahmed.Eissa]

creating security policy to allow specif users to use applications web-browsing and SSL with destination any with using SSL decryption policy which decrypt all.

after this policy there is implicit deny .

the issue that palo alto cant` detect youtube application , monitoring shows that is web-browsing  is permitted and falsh is denied !!!!

how i can block youtube appliaction ?

[HULK]

Hello Sir,

Could you please provide below mentioned information:

PA Platform-

PAN-OS-

Apps & Threat version-

I will verify the same and let you know the result.

Thanks

[kdd]

Hi Ahmed,

before the web-browsing rule i would insert this rule.

PA detects youtube-base etc. Is this what works for you?

Cheers Klaus

[HULK]

Hello Klaus,

You are absolutely correct. Without having SSL decryption, we can simply add the YouTube application in a security policy and it will successfully block YouTube video. ( Users will be able to open www.youtube.com, but they will not be able to run any video).

To Ahmed,

If you want to block all types of activity through www.youtube.com i.e. YouTube-posting, safe-mode, uploading, then you can use application= YouTube ( patent application) as mentioned below:

Reference doc: YouTube Video Control

How to Allow a Single YouTube Video and Block All Other Videos

Create a Custom Application for a YouTube Channel

Logs:

Hope this helps.

Thanks

[Ahmed.Eissa]

version 5.0.11

PA 3050

Threats 420-2111

apps 1217-1682

thanks for your support

[Ahmed.Eissa]

i did  create a deny rule to deny youtube  but it didn`t work ,...

.the main issue that the device is not detecting Youtube-saftey application , the only application is detected is youtube-base.

as shown below only flash is detected ,, note that destination ip is related to google .. really i cant understand why ???

this can identify youtube with a destination ip ( google !!!!)...

[Lahcen]

Hi Ahmed,

did you solve this problem i have the same issue i'm using PA-500 in virtual mode.

Best Regards

[Ahmed.Eissa]

nope it is still exist , i contacted palo alto support and have in progress ticket with them , i`ll inform you with updates

[Lahcen]

Thank you Ahmed,

    I'll be waiting for your reply.

BR

[dyang]

Hi Ahmed,

Google made a change a few months ago to the way they implement YouTube Safety Mode, which affects our ability to accurately identify this traffic with our youtube-safety-mode App-ID signature.  As such, the App-ID for YouTube Safety Mode will likely not show up anymore.  If you would like to enforce YouTube Safety Mode, you can do this via a URL filtering feature, "SafeSearch Enforcement".  When enabled, any Google, Yahoo or Bing web searches will be checked to make sure that the strictest Safe Search setting is enabled, and this applies to YouTube Safety Mode as well.  If the settings are correct, the search is allowed.  Otherwise, a block page is displayed, with instructions on how to correctly fix their settings.  Once this has been done, all subsequent searches will go through.  In order to ensure that YouTube Safety Mode is covered, please be sure to install content version 422 or later.

Thanks,

Doris