Cisco Umbrella - how to block what's app?

[ziqex]

Hi everyone,

I wanted to block WhatsApp completely on the network.

Application settings were used to block WhatsApp and destination lists were created and whatsapp.com & whatsapp.net added.

I can still access the pages. I am not seeing events for this traffic in Umbrella dashboard.

Don't have issues with other websites. Connection type IPsec tunnel to UMB DC. There are no exceptions for those domains directly on the tunnel. 

Any suggestions? The case is already with their support but wanted to ask in case someone come across something similar.

Thank you.

[howe]

Hi,

<EDIT: Actually read your question>

Given 'I am not seeing events for this traffic in Umbrella dashboard' it tells me that Umbrella isn't seeing any traffic and is thus unable to block the traffic or otherwise. 

When you say you arent seeing any events, can you confirm if you are seeing any DNS events? And if you do, its possible that these blocks are not applied on your DNS policy.  Im not overly familiar with whatsapp and what protocols its using, but it might be UDP and thus the web policy may be limited in scope.

Wireshark as usual will have the answers...might be worth going to policy-debug.checkumbrella.com and verifying you are hitting the expected policy, but regardlessof policy and block actions, if the traffic isnt in the dashboard, Umbrella isnt servicing those requests...

If you aren't seeing the DNS requests in your dashboard, then either the application isn't making DNS requests, or those DNS requests are being sent elsewhere. 

[ziqex]

Umbrella SIG Tunnel as the connection method

[ziqex]

I am not seeing any web or dns events. 

I have used policy tested and it shows that the traffic should be blocked.

Umbrella supports suggests DNS is being hijacked / intercepted by the ISP.

However, the issue is present in various locations therefore contacting various providers will be very challenging. 

[ziqex · Accepted solution]

WhatsApp traffic bypasses SWG if it is coming via IPSec tunnel. This is due to the global exemption in the Cisco backend.