Blocking TikTok

[workmen]

HI Guys, 

I created a Layer 3 outbound rule to block TikTok. I created 2 policy object groups namely TikTok [collection of TikTok IP addresses] and TikTok Domain [collection of TikTok domains] and call it on the L3 rule destination but despite that I am still seeing usage of TikTok, as if it was not blocked but I am seeing that it has 26 hits though. iPolicy ObjectsOutbound RuleHosts contributing to rule

[alemabrahao]

According to the screenshot, it is being denied in the rule you created. Have you done any validation to make sure they are still able to access it?

[workmen]

Yep they are still able to access it.

[michalc]

Certain apps like YouTube and TikTok are very difficult to block these days. You might want to try and fully block UDP port 443 (QUIC) if your main priority on the network is to block the TikTok but please check for collateral damage. 

[alemabrahao]

Take a look at this.

https://community.meraki.com/t5/Security-SD-WAN/Blocking-TIKTOK-in-2024/m-p/221020

[RWelch]

 

TikTok is recognized by NBAR.

Can you set a L7 DENY rule using TikTok?

After making the policy change, verify it lists TikTok

Safari can't connect now so it appears that L7 (stateless) blocking works, or it did for me anyway.

[RWelch]

You might continue to see Tiktok sessions that remain active sessions.

Firewall rules do not work on active sessions.

You'd need to wait like 10 minutes for the firewall to clear active session.

[michalc]

From your screenshots It seems that the DENY rule is being triggered, which aligns with the objective of blocking TikTok traffic.

Please see the very helpful KB on Layer 3 and 7 Firewall Processing Order.