We started blocking streaming media with a rule based on SurfControl. This
breaks Google Earth. There are three URL's / hosts that Goolge Earth
uses(kh.google.com, geo.keyhole.com and auth.keyhole.com) One is listed
in the SurfControl "streaming media" category (kh.google.com). I created
an "allow" access rule for all three of those URL's and placed it in the
list above the rule blocking "streaming media". After letting the rules
be read I tested and the "test" tool fails on "kh.google.com".

I then looked up the ip address for "kh.google.com" which is a CNAME entry
for "kh.l.google.com". I added "kh.l.google.com" to the URL allow access
rule and created another allow rule for the destination ip address
"" from my DIG of "kh.google.com".

Both of these rules are above the blocking rule for "streaming media". But
Google Earth still fails.

What am I missing?