Youtube Unable to Playback at Random Times

ebeckman

Having an issue where random times we are unable to play youtube videos.  The site loads but if you try to play a video it just spins.  Looking at dev tools when trying to playback a video the Zyxell is forcing a ssl cert which is causing cert name mismatch.  I have whitelisted all of youtube.com via content filter, dns filter, app patrol, none of it makes a difference in this.  I have even disabled the security filters and still have the problem.  But sometimes it works without issue and we don't see the cert name mismatch errors on youtube.com.  Furthermore we don't make use of SSL inspection so the firewall should not be trying to intercept ssl based traffic. This is on a Zyxel ATP 800 running firmware 5.35.

ebeckman

In fact I have found three other posts in this community for this exact same issue with youtube playback.  But they don't have a clear resolution as to what service in the firewall is causing this.  Or to what the actual resolution was.  Just saying was a policy rule, or just saying to check app patrol.

https://community.zyxel.com/en/discussion/comment/40882#Comment_40882

https://community.zyxel.com/en/discussion/comment/43482#Comment_43482

https://community.zyxel.com/en/discussion/14425/how-can-we-activate-recognition-of-the-dnsft-cloud-zyxel-com-certificate-to-enable-access-to-youtube

WJS

looks like URL was blocked by ThreatFilter. 
Did you have related log for that ?

Zyxel_Jeff

Hi @ebeckman

When you cannot watch Youtube, can you see any blocked messages on the event log( Firewall > Monitor > Event log)? It could be dropped by security services.

“ I have even disabled the security filters and still have the problem.  But sometimes it works without issue and we don't see the cert name mismatch errors on youtube.com. ”

Besides, why have you already disabled security filters but it still has problems, it could be there is a residual cache on your PC during that time. You can clean the cache from your browser and PC then try it again. Thanks.

ebeckman

https://community.zyxel.com/en/discussion/comment/48769#Comment_48769

No tags for it, but youtube.com *.youtube.com have been whitelisted in web content filter, DNS Content filter, DNS threat filter, and URL Threat filter.

ebeckman

https://community.zyxel.com/en/discussion/comment/48776#Comment_48776

No blocked messages on the firewall infact I can see events releated to youtube are all forwarded events.

When I disabled the security services on the firewall and tested, I tested with three different browsers, chrome, edge, firefox. Along with testing in each browsers incognito modes to make sure I wasn't runinng into a cached browser issue.

Today is a day where youtube is working for playback, but yesterday youtube playback just hung with the spining icon on the video and same errors in dev console with the zyxell intecpeting ssl traffice causing the ssl mismatch error that I screen shot in the first post.

Zyxel_Jeff

Hi @ebeckman

Thanks for your update. According to the Log, it seems you were blocked by App Patrol. Please check whether your existing App Patrol profile enables Youtube-related applications, if so please disable it. Thanks.

ebeckman

@Zyxel_Jeff

Well youtube is listed in app patrol and is set to forward. You can even see that in the log, so in theroy it shouldn't be dropping or rejecting this traffic right? I tried disabling the app patrol profile and same issue in chrome icognito mode, seeing the ssl name mismatch error in the console. But if I go through edge playback works. Now here is the kicker, I set app patrol profile back on and I get the same results. No playback in chrome icognito and can still play back in edge. This is the most hit or miss application control function I have used in a firewall. It should either be the app works or doesn't, not works sometimes. Also first thing this morning I was able to playback youtube video from chrome without issue, but at some point tihs afternoon playback stopped working. With no changes to the firewall during that time.

Zyxel_Jeff

Hi @ebeckman

Thanks for your verification and feedback. Do you enable SSL Inspection feature now? Thanks.

ebeckman

@Zyxel_Jeff

No, we do not make use of the SSL inspection, that function is completely disabled. As you can see from the screenshots it is not enabled and doesn't show that it has been interecepting SSL traffic.

ebeckman

I just checked and youtube playback is currently working in a normal chrome window. But in incognito mode it fails playback with the ssl name mismatch errors. Below is a screen shot of the logs during the time I tried playback in chrome incognito and normal window.