EXE file type blocked

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

EXE file type blocked

L4 Transporter

Hi,

 

I've one client complaining about exe file type get block without any file blocking profile configured.

I made sure we remove the whole security profiles from the security rule configured but still got the same.

I got File Transfer Blocked exception page!

 

Other types of file sometimes is working and sometimes is blocked but exe specifically is blocked all the time.

At the end I deleted all file blocking profiles and remove all profiles from the security rule and I got the same.

 

Have someone here experienced the same?

 

Regards,

Sharief

Regards,
Sharief
4 REPLIES 4

Cyber Elite
Cyber Elite

The only way that this should happen is if you have an additional Palo Alto upstream that could be serving this message. I would modify the page so you know if you are trully hitting one served by your Palo Alto or hitting one served by your upstream provider. 

Did you check threat logs? Maybe it's being recognised as malware. But that would only explain blocking some exe files, not all.

 

However focusing on one unsuccesful download atempt and checking all logs for that session will give you the answer if PA is involved in blocking or not.

Hi All,

 

Nothing in the threat log or data filtering but the session details is there in the traffic logs.

I had a session with client and only the following file is blocked:

 

downloads.solarwinds.com/solarwinds/Bundle/Bundle-856-OrionNPM-NetFlow.zip

 

Always got the file blocking page for this url.

I've deleted the whole file blocking profile, cleared the cache, changed the browsers but I got the same.

 

I took some pcaps and I'll check the routes now.

 

Regards,

Sharief

Regards,
Sharief

I'm wondering if you don't need to reboot to actually get the firewall to stop seeing the file block page? That shouldn't be the case but your system may be having a small issue. 

  • 3133 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!