topic web file blocking in Next-Generation Firewall Discussions

web file blocking

Deepa_D — Mon, 15 Dec 2025 06:09:53 GMT

Hello Community,

We are trying to implement file upload/download blocking for W-Web in our environment using a Palo Alto firewall.

Current setup:

SSL Forward Proxy decryption is enabled.

A decryption certificate has been created on the firewall and installed in the Trusted Root Certification Authorities store on client machines.

Security policy and File Blocking profile are configured to block file transfers for watsapp Web.

Issue observed:
Even after installing the firewall decryption certificate on the client machines, Wtsup Web continues to present the official Wtsapp certificate chain when verified from the browser. The firewall certificate is not being applied.

Questions:

Does Watsup Web use certificate pinning, which prevents SSL Forward Proxy decryption?

Is SSL Inbound Inspection or any additional SSL/TLS profile required for Wtsup Web file blocking?

Is it possible to block file transfers for Wtsup Web without SSL decryption, using App-ID or Content-ID?

Are there any known Palo Alto limitations or recommended best practices for Wtsup Web file blocking?

Any guidance or real-world experience on this would be greatly appreciated.

Thank you in advance for your support.

Re: web file blocking

Deepa_D — Tue, 16 Dec 2025 08:13:26 GMT

I have not used a decryption profile or anything similar. I just created a policy that allows Wtsapp-base, Wtsapp-chat, and Wtsapp-voice. Initially, I can see that Wtsapp upload and download are blocked, but if I click ‘try again’, I can upload the file. At first it is denied, but if I try again, the file transfer succeeds. Could someone please provide a solution if you are using this in your organization or have tried it in your lab and succeeded?

Re: web file blocking

Raido_Rattameister — Wed, 17 Dec 2025 14:01:23 GMT

Applications that use proprietary encryption or certificate pinning cannot be decrypted.

One example is WhatsApp.

You either permit it through or block it.

Another example is Dropbox.

You can decrypt if Dropbox is being used through web browser but not application as it has pinned certificate.