File blocking Profile on File Sharing Applications

[ErrantOsi]

Hello Guys

We have a security policy which goes with application & service any any to the internet. (that's another topic 😉 ) We want to block specific file types for downloading (.exe as an example). In the File blocking Profile we defined applications to any, configured the needed file types and set the action download to block. When we test downloads with the web application "wetransfer", we are still able to download .exe files over the configured security policy. Is file blocking not working with specific applications?

Thanks in advance 🙂

[SCantwell_IM · Accepted solution]

Howdy

The app wetransfer is using client-certifcates.  The FW cannot decrypt (if you have decryption or SSL forward proxy enabled.   So the FW cannot see/inspect any files.

Confirm this by looking at Device--> Certificate Management --> SSL Decryption Exclusion and search for wetransfer.

Recommendation may be to consider to DENY wetransfer, and find a different application to use, something the FW can decrypt, because you MUST have SSL Forward Proxy configurations to see inside of the tradtional SSL packets.

Thanks.