topic Re: Not blocking Eicar in 3.1.8 in General Topics

Not blocking Eicar in 3.1.8

mhuels — Mon, 11 Apr 2011 13:57:23 GMT

Since 3.1.8 the PAN do not identificates the Eicar "virus" in all cases. The loading from https://secure.eicar.org/eicarcom2.zip will be possible, but the same file with http://www.eicar.org/download/eicarcom2.zip will be blocked reliably.

Re: Not blocking Eicar in 3.1.8

dyang — Mon, 11 Apr 2011 17:39:21 GMT

Hi there,

It looks like you couldn't detect EICAR over HTTPS. Do you have an SSL decryption policy set and enabled?

Re: Not blocking Eicar in 3.1.8

michael_schumak — Mon, 11 Apr 2011 22:26:53 GMT

I would look at the SSL decryption. Tested it plenty of times, worked reliable every time.

Re: Not blocking Eicar in 3.1.8

mhuels — Tue, 12 Apr 2011 08:10:26 GMT

michael.schumak schrieb:

I would look at the SSL decryption. Tested it plenty of times, worked reliable every time.

https://secure.eicar.org/eicar_com.zip is blocked. Seems to be a disfunctionality with https and "double-zip". Curiously this morning https://secure.eicar.org/eicarcom2.zip is blocked too.

It is not the first time, i can see an erratic behaviour of the system. In case of doubt, the firewall should normaly block the data stream. I am not sure, if Palo Alto Networks assure that in every case.