topic Re: How to block MSN file transfer only in Network Security

How to block MSN file transfer only

guibarati — Wed, 13 Mar 2019 00:52:51 GMT

I have an ASA firewall and I want to block the users to transfer files in the MSN instant messenger. I know there is a feature in Application Policy that should take care of it but it's not workint, I've set the IM inspection and set the File-transfer to reset connection but the users are still able to transfer files through it.

Any idea?

Re: How to block MSN file transfer only

JORGE RODRIGUEZ — Thu, 20 Dec 2007 03:51:01 GMT

msm messanger file Transfers uses tcp ports 6891-6900, try blocking these..

http://www.chebucto.ns.ca/~rakerman/port-table.html

Rgds

Jorge

Re: How to block MSN file transfer only

john.dowson — Thu, 20 Dec 2007 10:38:34 GMT

Could you post the relevant section of your inspection config?

Re: How to block MSN file transfer only

guibarati — Thu, 20 Dec 2007 11:12:04 GMT

Sure, here it is:

class-map global-class

match default-inspection-traffic

class-map type inspect im match-all IM_MSN

match protocol msn-im yahoo-im

match service file-transfer

class-map mss_ajust

match access-list mss

class-map inside-class

match access-list inside_mpc

class-map IPS_map

match access-list IPS

class-map global-class1

match access-list global_mpc

policy-map type inspect im IM_Map

parameters

match not service chat

drop-connection log

policy-map IPS_policy

class IPS_map

ips inline fail-open

policy-map mss-http

class mss_ajust

set connection advanced-options mss-map

inspect http

policy-map global-policy

class global-class

inspect im IM_Map

inspect ftp

inspect icmp

class global-class1

ips inline fail-open

inspect im IM_Map

policy-map inside-policy

description Block msn

class inside-class

inspect im IM_Map

service-policy global-policy global

service-policy mss-http interface outside

service-policy inside-policy interface inside

I have tried to drop the traffic that maches:

not chat

file transfer

none has worked.

thanks

Re: How to block MSN file transfer only

guibarati — Fri, 21 Dec 2007 10:48:07 GMT

I blocked that ports but it did not work.

Re: How to block MSN file transfer only

JORGE RODRIGUEZ — Fri, 21 Dec 2007 13:07:39 GMT

Correct, I was wrong I tested it as well and did not work.. I guess this must be blocked through app layer protocol inspection rules, let me take a look and possibly lab this out.

Rgds

Jorge

Re: How to block MSN file transfer only

john.dowson — Fri, 21 Dec 2007 19:44:27 GMT

Thanks. Try replacing IM_Map as follows:

policy-map type inspect im IM_Map

class IM_MSN

drop-connection log

Re: How to block MSN file transfer only

azore2007 — Fri, 11 Jan 2008 15:07:31 GMT

Did you manage to block the file transfering with that solution?