topic EXE file type blocked in General Topics

EXE file type blocked

MohamedSharief — Tue, 31 Jan 2017 13:39:45 GMT

Hi,

I've one client complaining about exe file type get block without any file blocking profile configured.

I made sure we remove the whole security profiles from the security rule configured but still got the same.

I got File Transfer Blocked exception page!

Other types of file sometimes is working and sometimes is blocked but exe specifically is blocked all the time.

At the end I deleted all file blocking profiles and remove all profiles from the security rule and I got the same.

Have someone here experienced the same?

Regards,

Sharief

Re: EXE file type blocked

BPry — Tue, 31 Jan 2017 14:41:05 GMT

The only way that this should happen is if you have an additional Palo Alto upstream that could be serving this message. I would modify the page so you know if you are trully hitting one served by your Palo Alto or hitting one served by your upstream provider.

Re: EXE file type blocked

santonic — Wed, 01 Feb 2017 08:17:54 GMT

Did you check threat logs? Maybe it's being recognised as malware. But that would only explain blocking some exe files, not all.

However focusing on one unsuccesful download atempt and checking all logs for that session will give you the answer if PA is involved in blocking or not.

Re: EXE file type blocked

MohamedSharief — Mon, 06 Feb 2017 12:13:53 GMT

Hi All,

Nothing in the threat log or data filtering but the session details is there in the traffic logs.

I had a session with client and only the following file is blocked:

downloads.solarwinds.com/solarwinds/Bundle/Bundle-856-OrionNPM-NetFlow.zip

Always got the file blocking page for this url.

I've deleted the whole file blocking profile, cleared the cache, changed the browsers but I got the same.

I took some pcaps and I'll check the routes now.

Regards,

Sharief

Re: EXE file type blocked

BPry — Mon, 06 Feb 2017 17:29:51 GMT

I'm wondering if you don't need to reboot to actually get the firewall to stop seeing the file block page? That shouldn't be the case but your system may be having a small issue.