Palo Alto Configuration
In
Review the Palo Alto traffic-decryption, QUIC and URL-action settings described for Fastvue's YouTube reporting integration.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
For the FastVue YouTube Integration to work as expected there are a couple of requirements on Palo Alto firewalls.
- All YouTube traffic must be decrypted. While un-decrypted traffic will log the container page, to get all the video details that are contained in the URL the traffic must be decrypted. https://www.youtube.com/watch?v=6WtV1XtqsW0&list=RD6WtV1XtqsW0&start_radio=1
- QUIC protocol must be disabled. QUIC is not considered web traffic and it can't be decrypted, so there is no way to "see" the traffic to filter. QUIC can be turned off in 2 ways.
- In the browser, using Edge or Chrome policies by disabling the QuicAllowed policy.
- On the firewall using Security Policies. See When and how to Block QUIC Protocol on Palo alto Networks firewalls
Screenshot retained for review
- Ensure all URL Category Actions are set to either Alert or Block. While Allow works from a base reporting perspective, it doesn't log enough URL details for the YouTube integration to retrieve the video information from the API.
Screenshot retained for review