This article applies to:
- WebMarshal 6.1 and above
- Skype
Question:
- I want to use WebMarshal policy to control Skype.
Information:
To control Skype with WebMarshal, consider the following items:
- Use WebMarshal as a standalone proxy (not ISA plug-in)
- Restrict Skype native protocol ports at your firewall
- Enable WebMarshal HTTPS Content Inspection
- Enable the WebMarshal setting "Allow unidentified software to create tunnels"
- In WebMarshal HTTPS Rules, block use of invalid certificates when you want to block Skype.
Note: If you want to allow all Skype connections, see Trustwave Knowledgebase article Q12084: How can I allow all Skype connections when WebMarshal is installed?
1. Skype native ports
Like many Instant Message applications, Skype attempts to connect through its own protocol first, and then falls back on HTTPS.
Skype uses the following ports:
- TCP 1024 to 65536 Outbound
- UDP 1024 to 65536 Outbound
- UDP (Port defined during Skype Install) Inbound
To control Skype with WebMarshal, you must ensure that the TCP and UDP access to these ports is blocked and that WebMarshal is the only available HTTPS route.
2. HTTPS Content Inspection
To control Skype HTTPS connections, enable WebMarshal HTTPS Content Inspection. This step allows you to check the HTTPS negotiation used by Skype.
2. Allow unidentified software
Skype does not provide a User Agent header. To allow Skype connections through WebMarshal, enable the setting "Allow unidentified software to create tunnels" (found in the WebMarshal Proxy Wizard).
3. WebMarshal Rules - Block where SSL/TLS could not be negotiated
When connecting through WebMarshal with HTTPS inspection, Skype SSL negotiation fails.
If you are using WebMarshal HTTPS Content Inspection, to allow or deny Skype for individual users or workstations, you can apply the WebMarshal HTTPS rule condition "Where SSL/TLS could not be negotiated."
Create a rule similar to the following:
When a web request is received
For any users
Except where the user is a member of Allow Skype
And where addressed to any URL
And where SSL/TLS could not be negotiated
Block access to this site and display Blocked page
And do not process any further HTTPS rules
Place this rule at the top of the HTTPS Rules.
Notes:
This method potentially allows other content to pass uninspected for the allowed users, but a specially crafted application and server would most likely be required.
These instructions have been updated and validated at the time this article was written. If Skype behavior changes the required steps could change.
If you upgraded from WebMarshal 6.0 to 6.1 or above, is some cases you may find additional connections are unexpectedly blocked. For details, see Trustwave Knowledgebase article Q12083.
