Blocking Kazaa

[ryanropp]

I created a new protocol definition for kazaa and set it
up with udp/tcp port 1214 for inbound and outbound. We
only have one protocol rule that allows all traffic out.
I went into the rule and selected the option to allow all
traffic except for the selected, and I selected kazaa. I
restarted my services and I can still connect to kazaa,
why? What am I doing wrong?

Please help,
Ryan
.

 

[netuse]

Hi,
Who is the rule restricted too? and what kind of clients are you running, secure NAT, Firewall or proxy?

Try setting up a protocol rule denying everyone access to the Kazza ports.

regards

Netuse.

 

[rule0]

First, I am not familiar with ISA server (mostly checkpoint) but, maybe blocking access based on headers is a better way.
it is possible to make kazaa work with port 80 rather than 1214. So they will pass.
But you may block certain headers like:
"GET /.hash*"
"UserAgent: KazaaClient"
"X-Kazaa*" (a few headers start with this)

And according to Microsoft, you can do this with URLScan Web Filter for ISA:

http://download.microsoft.com/download/4/c/b/4cbe9a1f-8d97-4c71-b6b3-d967924981db/urlscan_readme.htm

I had no chance to try this at ISA server but I hope it works for you.

greetz,

Rule0

 

[Shahan]

Make a new rule and block kazza on port 1214,udp and tcp both!

 

[rsptt]

Hi -

Blocking these P2P clients is not a simple task. They are quite sophisticated in TCP/UDP connections and are tireless in looking for a way to connect.

You might want to checkout Akonix at

http://www.akonix.com.

They have a perimeter device that effectively blocks all popular P2P, as well as gives you true management of public Instant messaging.

They were recently favorably reviewed in eWeek.

They are an ISA partner as well.

http://www.microsoft.com/isaserver/partners/applicationfilters.asp