topic Re: Can PAN-OS 9.0 prevent user upload file size? in General Topics

Can PAN-OS 9.0 prevent user upload file size?

Houran — Sat, 29 Feb 2020 04:55:30 GMT

I want to limit the file size user can upload,for example prevent user from upload file larger than 100MB ,Less than 100MB can upload.

Tried but failed.
https://live.paloaltonetworks.com/t5/Management-Articles/Limiting-File-Size-Upload-using-Custom-Signature/ta-p/69156

Not sure if it is a version issue, currently it is PAN OS 9.0 and perform encryption and decryption.Is there any other way?

Thank in advance.

Re: Can PAN-OS 9.0 prevent user upload file size?

Retired Member — Sat, 29 Feb 2020 15:48:09 GMT

Can you confirm that the session is being decrypted? I haven't heard anything about the HTTP decoder changing in 9.0.

Re: Can PAN-OS 9.0 prevent user upload file size?

BPry — Sun, 01 Mar 2020 04:40:18 GMT

@Houran,

It would be handy to know what application you are trying to limit. The signature that the linked article has you create is the http-req-content-length, which should work for most content as long as you are performing decryption on the traffic.

There are some situations where you simply won't be able to do this if you allow certain clients to be utilized on the network, Dropbox is a good example of something that uses client certs and you can't decrypt this traffic, and thus this signature would never trigger.

If you feed us what you are trying to limit though, we can verify that this should be working.