FILE BLOCKING NOT INSPECTING ZIP CONTENT

[Renan_Ribeiro]

Hello everyone,

I'm trying to block download of CPL files (PE) using a file blocking profile. We are trying to create it in a way which assures that even zipped CPL Files will be blocked.

We created the profile but it did not work on HTTPS sites, just on HTTP sites. We were wondering if its necessary to create some kind of Decryption Policy or something like that to allow Palo Alto to block download of files under SSL.

[VinceM]

Hi,

For moment, a zip file is for palo a .... zip file 🙂 Not possible to block file if this one has been zipped .... yet 😉

Hope help

V.

[Renan_Ribeiro]

Hello Vince,

We did a test downloading an .exe zipped file over HTTP and Palo Alto blocked the download (The profile was set to block PE files). It just doesn't work with HTTPS sites.

[HULK]

Hello Renan,

Is this behavior is consistent across all browsers.. i.e IE, Chrome, firefox...?

Have you mentioned any specific application on your file-blocking profile..?

Example:

If so, please set application to any and test it again.

Thanks

[Renan_Ribeiro]

Hello HULK,

The application is already set to "any" and the issue is consistent across all browsers.

[HULK]

Is there any data-filtering logs has been generated for the same. GUI > Monitor> Logs > Data-Filtering.

Thanks

[Renan_Ribeiro]

Just the logs when  we download over http. We are not able to see any log about the downloads over HTTPS.

Best Regards

[HULK]

Do you have a chance to enable SSL decryption for a single host and let me know the result from that machine..?

Thanks