topic Re: Allow certain EXE downloads by filename in General Topics

Allow certain EXE downloads by filename

ghight — Tue, 26 Jul 2011 20:30:06 GMT

I use data filtering and currently block EXE downloads amoung others. My problem is now my users can't download updates to their malware software. The malware software we use currently doesn't offer a centralized management feature so the updates have to be downloaded from the web. The updates come from a content delivery network so the only way I can allow this without opening a huge hole in my security is by allowing a certain filename. Unfortuantely, I do not know of a way in my PA to allow an EXE downloads via filename while still blocking everything else. Is this possible? Thank you in advance.

Re: Allow certain EXE downloads by filename

kbrazil — Tue, 26 Jul 2011 20:58:40 GMT

There are App-ID's for various software updates. You can allow file downloads for those App-ID's. If your particular malware update is not covered by an App-ID you can either create your own custom one or put in an App-ID request to Palo Alto Networks: http://www.paloaltonetworks.com/researchcenter/submit-an-application/

Cheers,

Kelly

Re: Allow certain EXE downloads by filename

jdavis — Tue, 26 Jul 2011 21:00:31 GMT

Could you add a new "allow" policy using a FQDN Address Object for the content delivery network? Do not add a file blocking profile to the new policy. Position it before the policy with the file blocking profile that blocks .EXE files. Traffic would then match the new policy and be allowed. Downloads of .EXE files would still be blocked for traffic not sourced from the content delivery network by the existing policy with the file blocking profile.

Re: Allow certain EXE downloads by filename

ghight — Tue, 26 Jul 2011 21:08:09 GMT

I could, and that was my first idea... but since a VAST majority of downloads come this content delivery network, I would essentially be allowing everything rendering my EXE blocking only minimally effective.

I'll check in to Kelly's idea. I'm not familiar with that method, but it sounds like something I should know how to do anyway. Thank you both!