topic Re: Allowing special YouTube Videos in Firewall and Security Management

Allowing special YouTube Videos

Matthew81 — Thu, 25 Mar 2021 08:29:38 GMT

Hello,

i searched the community and found some threads with same content like mine here 🙂
But somehow no solutions are provided in these threads. So this is why i am writing a new question.

We are in a migration process from our BlueCoat Proxy to our 7000+ ClusterXL with R80.40

One special thing we do on our BlueCoat rulebase is, to block the category "Media Streams" for all users.
So YouTube is blocked to with this category block rule.

But we have some videos on YouTube we would like to allow them to the users.

For BlueCoat there are some knowledge base entries how to do that and it worked perfectly the last years.
Allowing a single YouTube video through a ProxySG (broadcom.com)

I tried to use the same exclusions etc. but somehow it will not work in the Check Point rulebase.
These are my exclusions where i would add all whitelisted videos in the future:

Is there somewhere a sk directly from Check Point (like from other proxy companies) where i can read how to do it?

Or maybe you guys have a solution how to do that.

I am not a regex expert, so a How To would be great 😉

For example, i tried this pattern:
(?=.*youtube\.com)(?=.*yts).*
But i get this Warning from Check Point:

So no idea how i can build it with the working exclusions from our BlueCoat.

Thank you.

Re: Allowing special YouTube Videos

HeikoAnkenbrand — Thu, 25 Mar 2021 09:38:39 GMT

Hi @Matthew81,

Check Point Signature Tool (for Windows OS) allows you to create Application Control and URL Filtering for your own, or third-party applications. This tool expands your local Application Control and URL Filtering database for applications and URLs that you add.

The GUI-based Signature Tool (for Windows OS) is available here.

Documentation:
Signature Tool for Application Control & URL Filtering blades Administration Guide
Signature Tool for Application Control blade Administration Guide

Re: Allowing special YouTube Videos

G_W_Albrecht — Thu, 25 Mar 2021 10:13:17 GMT

Why not ask TAC for a solution here ? Assertions in RegEx like (?= are meant for people who are RegEx experts, i fear 😉

For me, what you try to do looks like

https:\/\/[a-zA-Z]*\.youtube\.com\/[a-zA-Z.]*yts

Have a look at https://regex101.com/, a good place for learning and testing RegEx !

Re: Allowing special YouTube Videos

Matthew81 — Thu, 25 Mar 2021 11:50:54 GMT

Great - thanks a lot for the Signature Tool and the regex101 link. I will give it a try 😉

I tried now some easier RegEx for youtube:

youtube\.com\/yts\/
youtube\.com\/youtubei\/
youtube\.com\/api\/
youtube\.com\/sw.js
youtube\.com\/iframe_api
youtube\.com\/embed\/
youtube\.com\/get_video_info
crossdomain\.xml
consent\.youtube\.com
ytime\.com
googlevideo\.com
youtube\.com\/s\/
ytimg\.com
=ea6hH8uHRUc

And it seems to work like on the old proxy.
So i now need to transfer all the video id's from the old to the new.

I will try to use the Signature Tool to build a better custom application.

Re: Allowing special YouTube Videos

G_W_Albrecht — Thu, 25 Mar 2021 12:26:21 GMT

If i could help, any Kudo is appreciated 😉