YouTube app working with Steaming Cloud App Policy Enabled

(Michael Fiss) #1

I have my guest wireless subnet pointing to our vpn tunnel to zscaler. SSL inspection is off since I cannot enforce a certificate for non-company devices.

For the guest location in zscaler, I have the streaming category blocked for both URL filtering & Cloud App filtering.

Via Browser I get the zscaler block page. I get a generic error, such as connection was reset or 403 error.

Via the YouTube app, everything looks and works fine, like nothing was setup to be blocked.

I have tried working with support on this issue, and they have come to the conclusion that I need the Advanced Firewall addon to block non-standard ports (other than 80 & 443).

Does anyone block YouTube app without the Advanced Firewall?

Thanks in advanced!

(Michael Fiss) #2

Does anyone block YouTube app without the Advanced Firewall?

(Andy Logan) #3

@Naresh_Kumar_PM or @upalekar can one of you provide some direction here?

(Naresh Kumar ) #4

@Michael_Fiss We have Youtube ( web ) and Youtube HD( Streaming app for Mobile devices) available as Network apps with Adv Firewall to control access.

With out SSL inspection, we will only look at SNI in case of https and host name/URL path in case of http GET and enforce policy.

If support team confirms that traffic is not on 80/443 then adV FW is the only option.

(Naresh Kumar ) #5

one additional comment, Youtube app uses QUIC in some mobile devices and Zscaler do not enforce policies on QUIC traffic.

Instead you can block QUIC with std FW which forces the connection over 80/443. This is approach without adv FW.

(Michael Fiss) #6

I tried the firewall rule for blocking QUIC, but I can still play Youtube videos on the android app.

On the link you provided I see some options (Users, Groups, & Departments) that are grayed out (Advanced Firewall Subscription required). So I cannot tell if the firewall rule is actually working.

(Naresh Kumar ) #7

@Michael_Fiss I need more details to understand the issue. Please raise a support ticket or if there is already one, please ask the support team to loop me in, will look into it and provide feedback.