Administrators may observe that security policies configured to block YouTube commenting using dynamic application signatures are not effective. Traffic matching the application junos:YOUTUBE-COMMENT continues to pass, even when explicitly denied in the policy.

This KB explains the reason and the current status of the application signature.

Example configuration: 

set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 match source-address any
set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 match destination-address any
set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 match application any
set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 match dynamic-application junos:YOUTUBE-COMMENT
set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 match dynamic-application junos:YOUTUBE
set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 then deny

The dynamic application junos:YOUTUBE-COMMENT is a legacy application signature that was originally created many years ago based on older YouTube protocols and traffic patterns.

Over time:

• YouTube shifted to encrypted-by-default communication (HTTPS/TLS).
• Comment posting and retrieval operations are now processed through YouTube’s unified encrypted API endpoints.
• The legacy signature no longer detects modern comment‑related flows.

As a result, the signature does not match modern YouTube comment traffic, making this feature ineffective.

The signature junos:YOUTUBE-COMMENT is officially considered legacy.

Engineering has reviewed the signature and determined:

Junos:YOUTUBE-COMMENT will be formally deprecated in the upcoming signature pack release.