Blocking Skype?

Dec 15, 2006 3 Replies
C

Hello,



as far as I can see there is no way to block Skype via a Pix firewall. Now there is NBAR in Cico's IOS 12.4T. I thought I blocked it but it doesn't seem to work:



Version 12.4(4)T3



class-map match-any peer2peer description "Peer-to-peer stuff" match protocol gnutella match protocol edonkey match protocol fasttrack match protocol napster match protocol kazaa2 match protocol skype match protocol bittorrent ! policy-map p2p-drop description "Drop the unwanted peer-to-peer stuff" class peer2peer drop



interface GigabitEthernet0/0 ip address 192.168.8.254 255.255.255.248 no ip mroute-cache duplex auto speed auto no cdp enable service-policy input p2p-drop service-policy output p2p-drop


What is wrong here?



Regards, Christoph Gartmann



Vote
Twitter Facebook LinkedIn
M

Skype is an encrypted protocol that doesn't used fixed port numbers. And the authors keep changing the protocol to make it harder for firewalls to detect it.

Kind regards

Vote
Twitter Facebook LinkedIn
C

UTM Devices and CISCO ASA can block it

CK Christ> Hello,

Vote
Twitter Facebook LinkedIn
S

And if you allow access to port 80/tcp (i.e web browsing) then Skype will work - see the first reference below. The second reference suggests a rather complex way to block Skype, but I'd be surprised if it's implemented in any Cisco product.

Sam

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required