topic Re: Blocking Skype application doesn't work with ASA CX in Network Security

Blocking Skype application doesn't work with ASA CX

zheka_pefti — Tue, 12 Mar 2019 01:42:52 GMT

Hello folks,

I'm trying to build different content security scenarios for a potential deployment of ASA5500-X series firewall with CX module and ran into a trivial problem. A simple access policy has been configured to deny Skype. It's as simple as it sounds. To my surprise I don't see that it is being enforced.

I have all my pending changes committed, events are now showing with hits, see attached print screens. Tried to start Skype on my PC with the source shown on the print screen it and don't see any effects of this policy.

Am I missing something ? Can I have someone with a fresh pair of eyes ?

As a side note, I know for sure that other type of filtering does work, i.e. I have configured a deny filter for gambling URL category and it seems to work nicely.

Eugene

Re: Blocking Skype application doesn't work with ASA CX

Cotiso Marius Cetinoiu — Sat, 01 Jun 2013 12:58:52 GMT

Upgrade to ASA CX 9.1.2(21) everyting works like a charm atm.

Regards,

Cotiso

Re: Blocking Skype application doesn't work with ASA CX

Cotiso Marius Cetinoiu — Sat, 01 Jun 2013 13:43:03 GMT

Update:

With the last 9.1.1 ASA CX version, it seems that Skype can be blocked (99.9% of situations) efficiently solely with Skype signature.

In some particular cases (very rare), Skype seems to evade. If that happens, add to the Block-Skype policy also the Encrypted eMule (eDonkey, Kademlia) protocols which are responsable for TCP random encryption used by Skype.

Regards,

Cotiso

------------------

CCIE #26053

CCSI #33065

Re: Blocking Skype application doesn't work with ASA CX

zheka_pefti — Tue, 04 Jun 2013 05:48:51 GMT

Latest upgrade has been installed. Absolutely no difference in behavior before and after. The question is now about why advertize that CX can filter 1000+ applications but in reality it is a very tedious job to make it happen. Why would avarage admin jump through many hoops to realize that in order to affectively filter Skype and other applications you need to include a whole slew of other applications.

What about filtering bittorrent and IM applications? It's not 100 percent effective at all

Re: Blocking Skype application doesn't work with ASA CX

Jason Maynard — Sun, 02 Mar 2014 20:03:11 GMT

I had no issues blocking skype using the above. Created a application object and added Skype and Encrypted eMule (eDonkey, Kademlia) - Created DenySkype policy referencing the object. After this policy I allowed the following service objects tcp/eq 80, tcp/eq 443, tcp/eq 21 tcp/eq 53 udp/eq 53 (nothing squeeked by). I also created a Deny All Policy at the bottom.

"Skype cant connect"

Ciao,I'm doing some test with

ipagliani — Sun, 24 Aug 2014 17:55:29 GMT

Ciao,

I'm doing some test with ASA CX9.2.1.4 ( 5 ) and I'm not able to block Skype. Some time application is recognized bit it's allow by "implicit allow" and I don't undestand why.

I create a very simple policy as attached.

Thanks

I really wish everyone who is

zheka_pefti — Mon, 25 Aug 2014 05:32:39 GMT

I really wish everyone who is successful in filtering Skype shares how they did it. It's not consistent and doesn't work permanently