Block Skype Traffic on Cisco Router

Die Ciscos haben ein neues Konzept für die IOS Firewall implementiert. Mit dieser sollte auch das blocken von Skype möglich sein. ZoneBased Firewall Auf dem Ansatz der alten Lösung, Link, werd ich das ganze mal auf die ZBF übertragen. Hier der erste Ansatz:

--- snip ---
class-map type inspect http block-skype-class
match request method connect
!
class−map type inspect match−any private−allowed−class
match protocol tcp
match protocol udp
match protocol icmp
!
policy-map type inspect inside-outside-policy
class type inspect http block-skype-class
 drop
 log
class type inspect private−allowed−class
 inspect
class class-default
!
! the good
zone security inside
!
! the bad 
zone security dmz
!
! and the ugly
zone security outside
!
! combine inside and outside
! traffic goes from inside to outside
zone-pair security inside-outside source inside destination outside
service-policy type inspect inside-outside-policy
!
interface FastEthernet 0
zone-member security inside
!
interface FastEthernet 1
zone-member security outside
!
--- snip ---

Blok Skype Traffic

Mit Squid scheint es relative easy zu sein skype aus dem Netz zu bekommen. Mal schauen.

-- snip --
# Prevent Skype connecting HTTPs using CONNECT requests to IP addresses (those not using domain names)
acl numeric_IPs url_regex ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
http_access deny CONNECT numeric_IPs all
# Prevent Skype connecting http
acl Skype_UA browser Skype
http_access deny Skype_UA
# Prevent anyone to download anything from skype website
acl Skype_domain dstdomain skype.com
http_access deny Skype_domain
-- snip --