topic Skype Access in Network Security

Skype Access

jonhill — Sun, 10 Mar 2019 12:51:48 GMT

Currently we are using a proxy for internet access with an ASA 5525 on the gateway.

We've started getting a number of requests for Skype access and after much research found that our proxy can't deal with it and neither can the ASA, so its either open the firewall up to all specfic users un-restricted access thus bypassing the proxy or not give access at all.

My question is can the IPS module for the ASA drop or allow Skype connections and secondly if a Skype connections is allowed then can it be configured through the IPS to bypass the firewall ruleset?

Thanks

Jon

Skype Access

nearchib — Mon, 07 Jan 2013 16:32:53 GMT

Hey Jon,

We have a signature for Skype activity on the IPS:

11251-0 Skype Client Activity

However i believe this will only alert on the activity, it will not prevent Skype from working.

Skype has been designed to tunnel over legitimate protocols on a variety of ports and is therefore quite difficult to restrict.

I have heard that the best way to go about it is to rate limit it to an unusable level.

Regards

Neil Archibald

Skype Access

Andrew Phirsov — Wed, 09 Jan 2013 13:29:13 GMT

"However i believe this will only alert on the activity, it will not prevent Skype from working."

I think you can prevent anything from working as long as it's not encrypted, including skype. U just have to use any kind of traffic analyzer to see what application does, find something particular for application you're trying to block, write and tune signatures accordingly to what you see. I suppose u can do it even on any cisco ISR, using Flexible packet matching.

Skype Access

Karsten Iwen — Wed, 09 Jan 2013 14:06:06 GMT

If you want to use Skype, then the best method is to install the Skype-manager and control all access in a central way:

http://www.skype.com/intl/en/business/skype-manager/

On the IPS-module or your ASA-5525 it's not possible as all Skype-traffic is encrypted and can use many different transports. Perhaps the ASA-CX is more capable, but that's only a guess.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Skype Access

jonhill — Wed, 09 Jan 2013 14:17:17 GMT

I don;t see how the Skype Manager would improve the situation, it doesn't solve the issue of allowing access off the network.

Thanks

Skype Access

Karsten Iwen — Wed, 09 Jan 2013 14:29:34 GMT

I've interpreted your first post that way that you can allow skype, but not control it. Only for this control the Skype-manager can be a solution.

--
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni