Https traffic falsely identified as Skype Network Discovery, SID: 2

03/26/2020 10 8382

DESCRIPTION:
Https traffic falsely identified as Skype Network Discovery, SID: 2

RESOLUTION:

Applies to:

Case Number: 03386619
Product: SNWL NSA 2400 ENGLISH DEMO NFR
Firmware Version: 5.9.1.0

Problem Description:

When Skype is enabled (set to block) via application Firewall policies, it also drops https traffic towards webservers with Signature ID 2 under Firewall log and under packet monitor as IDP detection.

Workaround:

Skype Network Discovery, SID: 2 signatrue is an old signature and no longer required to block Skype.

Skype Network Discovery, SID: 2 signatrue:

Step 1: Navigate to Firewall | App control advanced.
Step 2: Type 2 next to "Lookup Signature ID:" text box and click on the magnifier icon and wait for the a window to pop up.
Step 3:  From the Edit App Control Signatrue displayed window, select disable from the drop down list next to Block and Log to disable this signature.

In order to block Skype new signatures has been added:

2800 Skype -- Application Activity 1
2867 Skype -- Application Activity 2 
2878 Skype -- Application Activity 3 
3644 Skype -- Application Activity 4 
5760 Skype -- Application Activity 5 
2052 Skype -- Application Activity 6 
3548 Skype -- Application Activity 7 
7651 Skype -- Application Activity 8 
7650 Skype -- DNS Skype 1 
2054 Skype -- DNS Skype 2 
2049 Skype -- DNS Skype 3