Blocking single Windows Media addresses?

rated by 0 users
Answered (Verified) This post has 1 verified answer | 2 Replies | 2 Followers

Not Ranked
1 Posts
FNBR posted on 3 Feb 2009 3:11

Running Websense Enterprise 6.3 is it possible to block or allow single Windows Media addresses?  I can allow or block single HTTP addresses through the Recategorized and Not Filtered sections.  I am allowing Windows Media streaming for training resources but need to block Internet Radio streaming.  I already have the 'Internet Radio and TV' category blocked in the Bandwidth group.  Certain users are crafty enough to connect to the stream directly without using the launcher site that I have blocked.  The RTA shows "Windows Media://96.17.8.151".

Thanks in advance,

Jim

|

Answered (Verified) Verified Answer

Top 25 Contributor
262 Posts
Moderator

Hi there,

Are the training recource and the radio stuff in the same site? If not, you may block streaming media category and the windows media protocol, create a custom protocol whose port is "all ports" and ip address is that of the training recource site, then permit this protocol in the protocol set being used.

Cheers

|

All Replies

Top 25 Contributor
262 Posts
Moderator

Hi there,

Are the training recource and the radio stuff in the same site? If not, you may block streaming media category and the windows media protocol, create a custom protocol whose port is "all ports" and ip address is that of the training recource site, then permit this protocol in the protocol set being used.

Cheers

|
Not Ranked
4 Posts

This solution does not work, at least not with WebSense 7.6

For instance, there is a Cal/EPA Webcast site that my users need to get to.  There is a Test URL at this page:

http://www.calepa.ca.gov/broadcast/

We have a bandwidth cap for all non-business essential categories and protocols, including Windows Media during high-bandwidth times.  This was blocking their access to this site during a high-bandwidth time.

I see that this site has the media hosted at media.ciwmb.ca.gov.  This resolves to the California Teale Data address space.  As we already allow all .gov sites, I figured there would be no problem following the suggestion in this thread of adding a custom protocol.

I created the custom protocol with all ports, IP Address Range 205.225.128.0 - 205.225.255.255, transport method TCP.  To test to see that it worked, I set the override action to Block.  I tested the URL again, still allowed.  Real-time show it is allowed.  I restricted it to only port 80, but it still doesn't block.

For now I have no choice but to remove my bandwidth filter for Windows Media.

|
Page 1 of 1 (3 items)