topic Re: FILE BLOCKING NOT INSPECTING ZIP CONTENT in General Topics

FILE BLOCKING NOT INSPECTING ZIP CONTENT

Renan_Ribeiro — Mon, 11 Aug 2014 14:59:19 GMT

Hello everyone,

I'm trying to block download of CPL files (PE) using a file blocking profile. We are trying to create it in a way which assures that even zipped CPL Files will be blocked.

We created the profile but it did not work on HTTPS sites, just on HTTP sites. We were wondering if its necessary to create some kind of Decryption Policy or something like that to allow Palo Alto to block download of files under SSL.

Re: FILE BLOCKING NOT INSPECTING ZIP CONTENT

VinceM — Mon, 11 Aug 2014 15:20:17 GMT

Hi,

For moment, a zip file is for palo a .... zip file 🙂 Not possible to block file if this one has been zipped .... yet 😉

Hope help

Re: FILE BLOCKING NOT INSPECTING ZIP CONTENT

Renan_Ribeiro — Mon, 11 Aug 2014 15:51:42 GMT

Hello Vince,

We did a test downloading an .exe zipped file over HTTP and Palo Alto blocked the download (The profile was set to block PE files). It just doesn't work with HTTPS sites.

Re: FILE BLOCKING NOT INSPECTING ZIP CONTENT

HULK — Mon, 11 Aug 2014 16:13:07 GMT

Hello Renan,

Is this behavior is consistent across all browsers.. i.e IE, Chrome, firefox...?

Have you mentioned any specific application on your file-blocking profile..?

Example:

If so, please set application to any and test it again.

Thanks

Re: FILE BLOCKING NOT INSPECTING ZIP CONTENT

Renan_Ribeiro — Mon, 11 Aug 2014 16:59:57 GMT

Hello HULK,

The application is already set to "any" and the issue is consistent across all browsers.

Re: FILE BLOCKING NOT INSPECTING ZIP CONTENT

HULK — Mon, 11 Aug 2014 17:08:44 GMT

Is there any data-filtering logs has been generated for the same. GUI > Monitor> Logs > Data-Filtering.

Thanks

Re: FILE BLOCKING NOT INSPECTING ZIP CONTENT

Renan_Ribeiro — Mon, 11 Aug 2014 17:15:57 GMT

Just the logs when we download over http. We are not able to see any log about the downloads over HTTPS.

Best Regards

Re: FILE BLOCKING NOT INSPECTING ZIP CONTENT

HULK — Mon, 11 Aug 2014 17:18:47 GMT

Do you have a chance to enable SSL decryption for a single host and let me know the result from that machine..?

Thanks