Block-Gmail Chat ( not Gmail)

[prashant dwivedi]

Hello Guys,

I want to know how to block Gtalk or gmail inbuilt chatting feature,  I want users should able to access the emails (gmail) and they should not be able to use chat facility. I want to achieve this using Cisco 5515X having FirePower Module.

Thanks,

Prashant

[nspasov]

Hello Prashant-

You can do that with FirePOWER. You will need to do two things:

1. Create a rule in your Access Policy (Policy > Access Control Policy) in which you are blocking the application called "Google Hangouts"

2. Create a SSL decryption policy. Google uses HTTPs, thus the session will need to be decrypted before in order for FirePOWER to be able to block the particular application while allowing everything else. 

I hope this helps!

Thank you for rating helpful posts!

[prashant dwivedi]

Guys,

sorry to say nothing worked for me, please find attached screenshot having policy configuration details.

Not sure whats wrong, I have called google hangout and google talk both as advised, I can still make a hangout call with my friends. 

is there anything am missing or any other ways to achieve the same?

Thanks!

[Marvin Rhoads]

Your screenshot did not come through.

What does the connection record show when your session is not captured by the policy?

[prashant dwivedi]

its saying allowed. haven't seen hangout being blocked, to test it further, I did specify 'gmail" as application in my policy and it got blocked.

I am not sure if there is any ways to block the hangout?

Thanks

[Andre Neethling]

Hi. I think Hangouts and GoogleTalk are different applications. Is it the "Chat enabled Gmail" window within the Gmail web page you want to block? If so,  that connection is to a specific URL. So you can either block the URL (I can't remember what it is), or if there is a category "Chat" in URL filtering, you can try that too. But that will block all chat applications/URLs.

[prashant dwivedi]

it didn't help! sorry.

any other advise please?

[nspasov]

Hi Prashant, did you configure a SSL Decryption policy? If you want to block just www.google.com or www.gmail.com then you don't need to decrypt the connection. However, if you want to block an application within that browser session (like hangouts) then you will need to decrypt the session. Otherwise, Sourcefire will never see that application being used. 

Thank you for rating helpful posts!

[Marvin Rhoads]

Hi Prashant,

I believe the app you are talking about is known a Google Talk in the FirePOWER application listing. See screen shot below.

You can call it out specifically in your rules that you build into your access control policy and make the action for it be "block".