topic Re: Issues blocking WhatsApp in Firewall and Security Management

Issues blocking WhatsApp

Blannier — Tue, 16 Sep 2025 00:32:46 GMT

Hi everyone,

I’m trying to block WhatsApp on my network using Check Point. I have applied the relevant policies and added the WhatsApp application categories/tags within Application Control.

The partial result is that images and audio are successfully blocked, but text messages are still being delivered without restriction.

Has anyone experienced the same issue? Is there any additional configuration required to fully block WhatsApp (including text messages) and not only multimedia files?

Re: Issues blocking WhatsApp

the_rock — Tue, 16 Sep 2025 03:14:59 GMT

What I always do is add custom category to block and simply add *whatsapp*, thats it. Works best if you have ssl inspection enabled.

Andy

Re: Issues blocking WhatsApp

the_rock — Tue, 16 Sep 2025 12:05:29 GMT

Also, forgot to mention, make sure there is no any rule in bypass policy that would allow this.

Andy

Re: Issues blocking WhatsApp

PhoneBoy — Tue, 16 Sep 2025 17:02:24 GMT

Not sure if this is one of the applications we can detect better as a result of updated Application Control signatures that we recently released.
Make sure those are up-to-date.

To further assist, we would need to see logs of accepted traffic (with sensitive details redacted) as well as version/JHF level.

Re: Issues blocking WhatsApp

Don_Paterson — Wed, 17 Sep 2025 13:07:24 GMT

Hey Andy,

What about the popup, thought?

I am also wondering if HTTPS Inspection is needed to fully control WA?

Regards,

Don

Re: Issues blocking WhatsApp

the_rock — Wed, 17 Sep 2025 13:10:29 GMT

Hey Don,

I never worry about that pop up and I will tell you why. Not to make fun or make this sound like a silly thing, but I cant even count how many hours I spent with one customer back in 2020 with TAC on the phone worrying about that message you posted and we finally realized after I tested this in the lab that doing *domain* was best way to fix those problems.

And yes, https inspection was indeed needed.

Andy

Re: Issues blocking WhatsApp

Don_Paterson — Wed, 17 Sep 2025 15:11:31 GMT

Thanks for that.

What about performance?

I see this in the HCP report. See attached

Is that he same config you recommended?

Cheers,

Don

Re: Issues blocking WhatsApp

the_rock — Wed, 17 Sep 2025 15:27:14 GMT

I had seen that many times, its expected in hcp report. Personally, I dont even pay attention now if I ever see that.

Andy

Re: Issues blocking WhatsApp

the_rock — Wed, 17 Sep 2025 16:43:10 GMT

Forgot to answer about performance...I had NEVER seen that cause any performance issues, either with any customer or in my lab.

Andy

Re: Issues blocking WhatsApp

Don_Paterson — Wed, 17 Sep 2025 17:35:10 GMT

Thanks.

We need a WhatsApp Updatable Object 🙂

Just been looking at the new feature in the latest JHFA (details below), and wondering if it can make it any better, but also just exploring the new feature.

... And also regex-style options to maybe optimize it. File attached.

I don't need it but was just curious to look into it. Will test it if I get a chance later.

https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/R82.00/Take_41.htm?tocpath=_____6

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Content/Topics-SECMG/Creating-Application-Control-and-URL-Filtering-Rules.htm?Highlight=%20%22Creating%20Application%20Control%20and%20URL%20Filtering%20Rules%22

PRJ-60279,
PMTR-114156

Application Control

NEW: This Take introduces the Dynamic URL List feature is an enhancement to the Custom Applications / Sites object (sk165094), allowing to maintain a dynamic list of URLs based on a feed file.

Refer to R82 Security Management Administration Guide > Topic "Creating Application Control and URL Filtering Rules".

Re: Issues blocking WhatsApp

the_rock — Wed, 17 Sep 2025 17:40:15 GMT

There are some 🙂

Andy

Re: Issues blocking WhatsApp

Don_Paterson — Wed, 17 Sep 2025 17:41:39 GMT

But no Updatable Object 😉

Re: Issues blocking WhatsApp

PhoneBoy — Wed, 17 Sep 2025 17:45:52 GMT

That's a great find!

Re: Issues blocking WhatsApp

the_rock — Wed, 17 Sep 2025 17:59:08 GMT

Yea, true that :). But, keep in mind, as others have stated before, CP, as Im sure is the case with any other vendor, would only show certain updatable objects if updated from 3rd party companies. Im fairly certain fw vendors dont control those things.

Andy

Re: Issues blocking WhatsApp

the_rock — Wed, 17 Sep 2025 19:03:35 GMT

Hey Don,

I did bit more checking on this and stumbled upon below, which lists IP ranges fore whatsapp.

Andy

https://raw.githubusercontent.com/HybridNetworks/whatsapp-cidr/main/WhatsApp/whatsapp_cidr_ipv4.txt

Re: Issues blocking WhatsApp

the_rock — Thu, 18 Sep 2025 15:08:32 GMT

Good day Don,

Im super curious to see how this works out for you, in regards to whatsapp. Please keep us posted.

Andy

Re: Issues blocking WhatsApp

Don_Paterson — Fri, 19 Sep 2025 07:25:11 GMT

Hi Andy,

I tried it yesterday but unfortunately could not get it working.

I think that I tried everything (Regex tick box and removing underscores from the app name etc.) but no luck.

Let me know if you can spot any mistakes in the attached.

One thing that is confusing me is this:

:path (https://172.16.4.191/urls) # Must be the same as configured in the file "urls.txt" and in the Custom Application/Site object

Cheers,

Don

Re: Issues blocking WhatsApp

the_rock — Fri, 19 Sep 2025 10:42:19 GMT

Hey Steve,

All I did was add *whatsapp* and do NOT check regular expressions, thats it. Rule looks right.

Andy

Re: Issues blocking WhatsApp

Don_Paterson — Fri, 19 Sep 2025 11:09:54 GMT

Steve? Who's Steve 😉

It's early morning over there ☕ ☕

I am giving you feedback on testing the new R82 JHFA 41 Dynamic URLs feature.

I want to see that working internally and can then look at the git reference (external) after I see it working with a simple config.

Regards,

Don

Re: Issues blocking WhatsApp

the_rock — Fri, 19 Sep 2025 11:12:38 GMT

Geesh, sorry Don...I was responding to Steve on another post and just typed that here too lol, my bad mate.

For what is worth, you can call me Larry, thats name I got ages ago when my ex's mother could never remember my name haha

Anyway, I tested this in R82 jumbo 41, works fine.

I will attach some screenshots later.

Andy