Viber Allowed and Working but no File Transer 80

I have a client wanting to have viber and only selected internet sites allowed. Viber is working when sending and receiving messages, but file transfer does no work. Client does not want a blanket config, because when we allow certain protocols and applications in App control Policy, it also allows the many sites that should be denied . The problem we cannot isolate is the hidden protocol and destination that is being denied for file transfer. We tried to enable SSL for all destinations but it also allowed restricted sites to come through. is there any possible workaround to this to isolate allowing viber file transfer protocols?

I understand the issue, we also faced similar case in one environment.

Viber messaging works fine but file transfer use different hidden endpoints and sometimes goes through dynamic SSL channels, so normal App Control rule not enough.

What we did was allow Viber full application first in test group, then used SSL inspection + log monitoring to identify blocked domains for file transfer. After that we created custom allow rules only for those specific endpoints instead of opening full internet.

Maybe you can try same approach, otherwise it becomes very hard to isolate only file transfer traffic without affecting other restricted sites.

Because Viber file transfers sometimes use different servers, CDN endpoints, and encrypted HTTPS connections than standard texting, this is a frequent problem. If file transfers are unsuccessful but communications are successful, I would advise:

Try a file transfer after turning on logging under the refuse policy.
To find the restricted application, domain, or destination IP during the test, examine the NGAF traffic, application control, and URL logs.
Because Viber file transfers may rely on encrypted HTTPS traffic that cannot be correctly recognised without decryption, make sure SSL inspection is enabled.
Instead of allowing general categories, create a specific allow rule for the discovered Viber-related application, domain, or destination.
Keep an eye on several transfer attempts if CDN services are used, as the destination could change over time.
To determine the precise protocol and destination being blocked during a failed transfer, use packet capture on the NGAF.

Instead of granting broad application or protocol permissions that could allow harmful websites, the best course of action is typically to identify the prohibited destination from logs or packet captures and create a specific exception.

This is a common challenge because Viber file transfers often use different servers, CDN endpoints, and encrypted HTTPS connections than regular messaging. If messages work but file transfers fail, I would recommend:

Enable logging on the deny policy and attempt a file transfer.
Review NGAF traffic, application control, and URL logs during the test to identify the blocked application, domain, or destination IP.
Check whether SSL Inspection is enabled, as Viber file transfers may rely on encrypted HTTPS traffic that cannot be properly identified without decryption.
Create a specific allow rule for the detected Viber-related application, domain, or destination instead of allowing broad categories.
If CDN services are involved, monitor multiple transfer attempts because the destination may change dynamically.
Use packet capture on the NGAF during a failed transfer to identify the exact protocol and destination being blocked.

The best approach is usually to identify the blocked destination from logs or packet captures and create a targeted exception rather than enabling broad application or protocol permissions that may allow unwanted websites..

Yes—it's a strict internet whitelist for applications like Viber.

The challenge is that Viber file transfers don't rely on the visible signature of the Viber application. But also on
- CDN/dynamic cloud destinations
- HTTPS over multiple domains
- SSL-encrypted traffic
- Sometimes QUIC/HTTP3
- Background API calls
For Sangfor NGAF, enable:
- SSL Decryption
- Threat intelligence logging
- Session tracking
- Application dependency visibility