Customer is unable to block YouTube, Facebook, and Instagram commenting using dynamic application matching on SRX firewalls.

Although the base applications (for example, junos:YOUTUBE) are detected successfully, comment‑specific dynamic applications (for example, junos:YOUTUBE-COMMENT) are not matched or enforced.

• Traffic related to YouTube is detected correctly.
• Commenting actions on YouTube (and similar services) are not blocked, even when:
  • Dynamic application policies are configured
  • SSL proxy is enabled or disabled
• Policy hit count does not increment for comment‑specific dynamic applications.
• AppID statistics show only the base application.

root@SRX-TEST> show services application-identification statistics applications | match youtube

                         YOUTUBE               235          88841282          No

YOUTUBE is detected, but YOUTUBE-COMMENT is never detected.

Sample Configuration (Issue state)

set security policies from-zone trust to-zone wan0 policy BLOCK-QUIC-DNS-ENC match source-address any

set security policies from-zone trust to-zone wan0 policy BLOCK-QUIC-DNS-ENC match destination-address any

set security policies from-zone trust to-zone wan0 policy BLOCK-QUIC-DNS-ENC match application any

set security policies from-zone trust to-zone wan0 policy BLOCK-QUIC-DNS-ENC match dynamic-application junos:QUIC

set security policies from-zone trust to-zone wan0 policy BLOCK-QUIC-DNS-ENC match dynamic-application junos:DNS-ENCRYPTED

set security policies from-zone trust to-zone wan0 policy BLOCK-QUIC-DNS-ENC then permit application-services idp-policy BLOCK_ECH_IDP

set security policies from-zone trust to-zone wan0 policy BLOCK-QUIC-DNS-ENC then log session-init

set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 match source-address any

set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 match destination-address any

set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 match application any

set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 match dynamic-application junos:YOUTUBE-COMMENT

set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 match dynamic-application junos:YOUTUBE

set security policies from-zone trust to-zone wan0 policy LAN-POLICY1 then deny

After investigation, it was confirmed that:

• youtube-comment is a legacy Juniper application signature
• Legacy applications are not fully supported by the modern AppID / dynamic application framework
• Engineering has officially decided to deprecate youtube-comment in upcoming signature pack (sigpack) releases
• As a result:
  • junos:YOUTUBE-COMMENT will not reliably match traffic
  • Enforcement using security policies is not supported

Similar limitations may apply to other legacy “sub‑function” application signatures

AppID statistics may show only parent applications (for example, YOUTUBE)

Workaround: UTM Web Filtering

To block YouTube commenting functionality, Juniper recommends using UTM Web Filtering (NG‑Juniper) instead of AppID dynamic applications.

This approach:

• Uses URL and content categorization
• Works reliably with SSL inspection
• Is actively supported and maintained

set security utm traceoptions flag all

set security utm default-configuration web-filtering http-persist

set security utm default-configuration web-filtering type ng-juniper

set security utm default-configuration web-filtering traceoptions flag all

set security utm default-configuration web-filtering ng-juniper cache timeout 1800

set security utm default-configuration web-filtering ng-juniper cache size 16k

set security utm default-configuration web-filtering ng-juniper server tls-profile init

set security utm default-configuration web-filtering ng-juniper cache-preload

set security utm feature-profile web-filtering ng-juniper profile utmcommonprofile category NG_YouTube_Commenting action block

set security utm utm-policy utmcommonpolicy web-filtering http-profile utmcommonprofile

set security policies from-zone trust to-zone untrust policy p1 match source-address any

set security policies from-zone trust to-zone untrust policy p1 match destination-address any

set security policies from-zone trust to-zone untrust policy p1 match application any

set security policies from-zone trust to-zone untrust policy p1 match dynamic-application any

set security policies from-zone trust to-zone untrust policy p1 then permit application-services ssl-proxy profile-name ssl-inspect-profile

set security policies from-zone trust to-zone syslog policy p1 then permit application-services utm-policy utmcommonpolicy

set security policies from-zone trust to-zone untrust policy p1 then log session-init

set security policies from-zone trust to-zone untrust policy p1 then log session-close

set security policies from-zone trust to-zone untrust policy p1 then log session-update 1