Hello homicidedart
To block the different file types we select the the file types and give the direction based on if it is upload, download or both direction and give action as block. Some points to look for,
> Direction should be checked can give both to block both directions.
> Security rule should have action as Allow. Block is the action only on the file-blocking profile.
> If there are more than one rule in the file blocking profile we will have to have this rule in the top or more specific rule in the top and more generic in the bottom.
> Also look at the session id details for this traffic to see details about file blocking / sec rule matching and so on to isolate the cause.
If all these would not help then flow basic has to be done to analyse at packet level.
Hope this helps !
Thanks
Hi Phoenix,
Thanks for your reply, while I see the Configuration you said is the same as mine. I looked at the session ID, and I see nothing about the file.
but in real the file is copied to and from the share directory without any blocking.
How can it be solved.
Regards,
Maher
Hi Panos,
Sorry for late reply,
here you are the Required output
admin@PA-SRV-2# show rulebase security rules FileServer-Rule
FileServer-Rule {
option {
disable-server-response-inspection no;
}
from any;
to any;
source Sukari-Clients;
destination FileServer-Group;
source-user any;
category any;
application FileServer-Apps;
service application-default;
hip-profiles any;
action allow;
log-start yes;
log-end yes;
negate-source no;
negate-destination no;
disabled no;
profile-setting {
profiles {
file-blocking "prevent on file server";
virus Antivirus-Block;
spyware Anti-Spyware-Profile;
vulnerability "Vulnerability Profile";
}
}
}
admin@PA-SRV-2# show profiles file-blocking "prevent on file server"
"prevent on file server" {
rules {
"Standard users" {
application any;
file-type [ apk avi avi-divx avi-xvid bat cab class dll exe flv hta jar mov mp3 mp4 reg rm torrent wmv wsf];
direction both;
action block;
}
}
}
Regarding the session ID output, I found the output is different from the GUI output
admin@PA-SRV-2> show session id 536401
Session 536401
c2s flow:
source: 192.168.102.217 [trust]
dst: 10.10.50.5
proto: 17
sport: 47043 dport: 53
state: INIT type: FLOW
src user: centamin\pan-admin
dst user: unknown
s2c flow:
source: 10.10.50.5 [untrust]
dst: 192.168.102.217
proto: 17
sport: 53 dport: 47043
state: INIT type: FLOW
src user: unknown
dst user: centamin\pan-admin
start time : Mon Dec 30 09:06:41 2013
timeout : 30 sec
total byte count(c2s) : 87
total byte count(s2c) : 103
layer7 packet count(c2s) : 1
layer7 packet count(s2c) : 1
vsys : vsys1
application : dns
rule : DNS Attack drop
session to be logged at end : True
session in session ager : False
session synced from HA peer : False
layer7 processing : enabled
URL filtering enabled : False
session via syn-cookies : False
session terminated on host : False
session traverses tunnel : False
captive portal session : False
ingress interface : ethernet1/2
egress interface : ethernet1/1
session QoS rule : N/A (class 4)
So, I tried another one and I found the same thing.
$ Data Filtering output
$ Traffic Logging output
$ CLI output
admin@PA-SRV-2> show session id 3993
Session 3993
c2s flow:
source: 192.168.102.217 [trust]
dst: 10.10.50.5
proto: 17
sport: 60918 dport: 53
state: INIT type: FLOW
src user: centamin\pan-admin
dst user: unknown
s2c flow:
source: 10.10.50.5 [untrust]
dst: 192.168.102.217
proto: 17
sport: 53 dport: 60918
state: INIT type: FLOW
src user: unknown
dst user: centamin\pan-admin
start time : Mon Dec 30 08:52:22 2013
timeout : 30 sec
total byte count(c2s) : 93
total byte count(s2c) : 447
layer7 packet count(c2s) : 1
layer7 packet count(s2c) : 1
vsys : vsys1
application : dns
rule : DNS Attack drop
session to be logged at end : True
session in session ager : False
session synced from HA peer : False
layer7 processing : enabled
URL filtering enabled : False
session via syn-cookies : False
session terminated on host : False
session traverses tunnel : False
captive portal session : False
ingress interface : ethernet1/2
egress interface : ethernet1/1
session QoS rule : N/A (class 4)
