Block P2P traffic

Question

Hello,
I have tried the below configuration to block the P2P traffic.But still the users can download using utorrent client. How do I effectively block all the P2P traffic. Please help.
Class Map
class-map type inspect match-any ALL-P2P-PROTOCOLS
match protocol edonkey signature
match protocol gnutella signature
match protocol kazaa2 signature
match protocol fasttrack signature
match protocol bittorrent signature
class-map type inspect match-all P2P-PROTOCOL
match class-map ALL-P2P-PROTOCOLS
match access-group name INTERNET-ACL
class-map type inspect http match-any HTTP-PORT-MISUSE
match  request port-misuse im
match  request port-misuse p2p
match  request port-misuse tunneling
Policy Map
policy-map type inspect http HTTP-PORT-MISUSE-POLICY
class type inspect http HTTP-PORT-MISUSE
  reset
  log
policy-map type inspect IN-TO-OUT-POLICY
class type inspect P2P-PROTOCOL
  drop log
class class-default
  drop log
class type inspect HTTP-ACCESS
  inspect
  service-policy http HTTP-PORT-MISUSE-POLICY
Also I am attaching the logs and 'show policy-map type inspect zone-pair IN-TO-OUT' output.
Please help me out.
Regards,
Tony

Answer 1

Hello Tony,
Okay. I have seen on the last couple of days that because of how this protocols are being tunneled or jumping from one port to another, etc. Its pretty difficult to blok it with ZBFW.
So instead of doing that I would like to check if we can block it with NBAR, can we give it a try ??? If yes, here is how
class-map match-any p2p
match protocol edonkey
match protocol fasttrack
match protocol gnutella
match protocol kazaa2
match protocol winmx
match protocol skype
match protocol cuseeme
match protocol novadigm
match protocol ssh
match protocol irc
policy-map P2P-DROP
class p2p
drop
Apply the policy to the user-facing (incoming) interface.
int xxxxx
You can verify the status by doing:
sh policy-map int xxx
sh ip nbar protocol-discovery
Let me know the result,
Remembe to rate all of the helpful posts
service-policy input P2P-DROP