topic Re: skype and whatsapp are not working through firepower in Network Security

skype and whatsapp are not working through firepower

Samer R. Saleem — Fri, 21 Feb 2020 14:57:06 GMT

Hi,

i have rule configured to allow traffic to some applications like :Viber, Skype, Whatsapp

Viber is working good, Skype no and whatsapp also not working....

i have added all the available applications that appears when searching the filter list for skype and whatsapp

can anyone help?

thanks

Re: skype and whatsapp are not working through firepower

mikael.lahtela — Wed, 13 Dec 2017 17:48:12 GMT

Hi,

I think you need to provide us how you are configuring the rules and also what platform/software you are running?

br, Micke

Re: skype and whatsapp are not working through firepower

Samer R. Saleem — Wed, 13 Dec 2017 17:58:17 GMT

Hi,

this is the rule, AD user permitted for applications in the list SKYPE whatsapp,...etc

im using Firepower over ASA5512-X, version is 6.2

Re: skype and whatsapp are not working through firepower

mikael.lahtela — Wed, 13 Dec 2017 18:10:47 GMT

Do you get block logs in connection events and if so what do the look like?

br, Micke

Re: skype and whatsapp are not working through firepower

Samer R. Saleem — Thu, 14 Dec 2017 05:57:47 GMT

the action is block please check attached.

Re: skype and whatsapp are not working through firepower

mikael.lahtela — Fri, 15 Dec 2017 11:36:39 GMT

Ok, so you have block on all "Skype tunneling"?
If you look in the table view och connection events, can you see what rule the application is blocked on?
Can you do a packet-trace from and post that here?
Is the Skype Tunneling included in the rule?

br, Micke

Re: skype and whatsapp are not working through firepower

Samer R. Saleem — Sun, 17 Dec 2017 09:56:57 GMT

Hi,

i have added the skype tunneling, but still the same, and the thing is i noticed the initiator user shows unknown in the connection events, while im trying to filter based on username...

after checking i found my AD user agent domain is not matching with realm configs for AD primary domain

i have changed both to be matching now but still the user is not showing, while its showing in user activity list...

checking some websites, it seems to be a bug in Firepower, I'm using v6.2.0.2

any idea how to solve this issue?

Re: skype and whatsapp are not working through firepower

mikael.lahtela — Fri, 22 Dec 2017 12:19:02 GMT

ok, to get rule hit all the variables configured in the rule must match.
So if you have a rule that is defined as allow, source network, application and user you need to get match on all three of the parameters for the rule to work.
Sounds like you have some kind of issue with the AD user agent, guess you need to try to figure out what the problem is with that.
If the configuration looks correct and it's still not working I would sudgest to contact Cisco TAC.
Here is some links, some of the information might be old:
https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118131-technote-sourcefire-00.html

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118674-technote-useragent-00.html

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118159-troubleshoot-firesite-00.html

br, Micke