topic Re: How to block csv files download by File-Blocking in General Topics

How to block csv files download by File-Blocking

paloalto.netfos — Tue, 07 Aug 2012 03:13:38 GMT

Hi All,

I just want to block csv files download by file-blocking, however I cann't find it in the file types.

Are there any ways to block it download?

Thanks,

Joy,

Re: How to block csv files download by File-Blocking

rmonvon — Tue, 07 Aug 2012 04:00:01 GMT

Hi...CSV is just plain text file with commas separating the fields. The PA device should identify the csv file as text file. Thanks.

Re: How to block csv files download by File-Blocking

paloalto.netfos — Tue, 07 Aug 2012 04:46:04 GMT

Hi rmonvon,

Thanks for your answers, but I have tried upload a .txt text file to gmail and no any log about it displayed in the Data-Filtering. I also cann't see text or txt file type in the file-blocking file type.

My test unit is PA-5020 and PANOS is 4.1.6-h1.

Thanks,

Joy,

Re: How to block csv files download by File-Blocking

rmonvon — Tue, 07 Aug 2012 05:38:25 GMT

My apology on the file blocking as we do not have a file type for .txt. It would match many web contents since all web pages will have some text on them. You could try defining a custom app signature to match .csv similar to the recommendation here to detect jpg and mp3:

For Data Filtering, we do have text/html as a file type to scan but Data Filtering is looking for a data pattern inside the file like credit card numbers. You should also check to see if gmail is using SSL to encrypt the transfer as I believe it is. You will have to enable SSL decryption on the PA5020 to inspect inside of SSL and scan the content for data patterns.

Thanks.

Re: How to block csv files download by File-Blocking

paloalto.netfos — Fri, 10 Aug 2012 03:23:59 GMT

Hi rmonvon,

Thanks for reply, and what is default behavior when file-booking detects unknown file type, ignores but logs it? ignores without logs? bypass without anything? blocks it but logs it? blocks it without logs?

Thanks,

Joy,

Re: How to block csv files download by File-Blocking

rmonvon — Fri, 10 Aug 2012 04:09:23 GMT

For unknown file types, the action would be bypass (allow) & no logging.

Re: How to block csv files download by File-Blocking

jwolach — Sun, 12 Aug 2012 19:06:16 GMT

Are you decrypting the gmail traffic with a Forward-Proxy Rule? If not, you will not see the file attachments because gmail is an encrypted application.

Re: How to block csv files download by File-Blocking

jwolach — Sun, 12 Aug 2012 21:50:11 GMT

I just modified the .JPG App-ID signature for .CSV. Here it is. Just import it into the Application Object and create a Block Security Policy.

Re: How to block csv files download by File-Blocking

paloalto.netfos — Mon, 13 Aug 2012 01:13:24 GMT

Hi Jwolach,

Yes, I do ssl forward-proxy in my unit, and I can see the traffic log of gmail, but Data-Filtering is not.

Re: How to block csv files download by File-Blocking

paloalto.netfos — Mon, 13 Aug 2012 01:26:05 GMT

Hi Jwolach,

Thanks for your sample, I will try it.

Regards,

Joy,