Steaming_Block

[jsanda]

Hello guys,

I was trying secure a guest wifi from illegal torrent streaming. i set up  web filters , application control and all work fine. But we found a <<hole>> lets say.

A user used hotspot from his phone and connected to a streaming site (from the ones we have blocked) . The problem is that when he connected to our wifi the movie continued to play . 

Is there a way to stop that session with the site automatically?

I was thinking something like a reoccuring Session killer to particular sites. is it possible?

FortiGate 

[ebilcari]

It is likely that the site is using a CDN to deliver the streaming content. You'll need to identify and block that destination as well.

[jsanda]

I'm blocking the traffic through web filter not destination. The destination should have the same type of web traffic (same category) isn't it?

Is there any possibility to continue streaming because the firewall just see UDP traffic after the established http?

Please correct me if i am wrong to something.

[ebilcari]

I suspect that the user initially opens the blocked page via the hotspot to retrieve the streaming link. The link is then used over WiFi as a new connection, but it fails to be classified as a blocked URL, most likely because it originates from a different domain or a well-known CDN.

[jsanda · Accepted solution]

Finally , it was all about the Web FIlter . We block Streaming and Downloading category and when the host connect to our SSID the streming stopped after half to one  minute (just played the cached packet probably).  

Furthermore, this created another problem . Youtube also stop streaming , even we could access the web site because of the url filters. I search and found the solution in another ticket (id:195422) . Security profile -> Web rating overrides -> category custom 1 . Add all urls about youtube and allow custom 1 in the web filter applied to the rule of SSID access the internet.

Thanks for your time!