Data filtering blocking when it should not

[agrijalba]

We were testing File Blocking and found that it was blocking too much.

The configuration consisted of 2 rules:

- Applications = ms-ds-smbv1,  File-types=any, Action=continue

- Applications = any,  File-types=any, Action=alert

The test was to download an excel file using SMBv1, and result was blocked.

We would expect that it would allow it.

If we just change the action of the first rule from "continue" to "alert" then it works.

Direction is always "both" for all rules.

Version is 8.0.13.

[agrijalba]

By the way this is Data Filtering configuration.

We are not sure why this is blocking SMBv1 downloads.

[BPry · Accepted solution]

@agrijalba

You can't use Continue on ms-ds-smb traffic as the firewall can't generate the continue page, that really only works in a browser. 

continue —A message to the user indicates that a download has been requested and asks the user to confirm whether to continue. The purpose is to warn the user of a possible unknown download (also known as a drive-by-download) and to give the user the option of continuing or stopping the download.When you create a file blocking profile with the action continue, you can only choose the application web-browsing. If you choose any other application, traffic that matches the Security policy will not flow through the firewall due to the fact that the users will not be prompted with a continue page.