I currently have a security rule that blocks the downloads of ".exe" files from the "unknown" URL category (which sits above my general Internet/WildFire Forward rule). It works extremely well in dropping a huge amount of the garbage out there. However, occasionally the garbage makes it past that rule and sends up a WildFire event. Again, Deny rule comes before the WildFire forward. I noticed from the WildFire alert that in the cases of communication which appears to bypass the deny rule - the source and destination are actually reversed to what the rule is set. Instead of my user being the source - it is now the destination. Should my rule to deny the .exe also include a bidirectional zone?
Current Deny .exe rule
Source Zone - Internal
Destination Zone - External
Application - Web-Browsing
URL Category - "Unknown" (PANDB)
Profile - "DenyEXE" File blocking profile for .exe/download/block
Should my zones be a bidirectional setup to block anything that is coming inbound? I had hoped the user session would keep state of that? Should the File Blocking profile be both upload and download? Thanks!
Solved! Go to Solution.
Want to add that if adding the bidirectional zone would be beneficial - it concerns me to add "external" source to "internal" destination in this case. How big a concern is that in this particular setup? We are NAT'd behind the external interface. Thanks.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!