How to block additional file types?

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
Not applicable

How to block additional file types?

Hello guys,

Can you please advise how we can restrict access to file types such are .vbs and .msi?

These types are not available in the File block list.

Kind Regards,

John

Highlighted
L4 Transporter

John,

We just added MSI to this weeks content release. You should see it

show up if you upgrade to content update 150. We don't currently have

support for VBS files but we can take a look at adding support for

them in a future content release.

Mike

Highlighted
Not applicable

Thanks for the quick reply, I've just updated and added .msi to the block list.

Would it be possible to investigate if the following file types can be blocked?

.ade

.adp

.bas

.com

.cmd

.cpl

.lnk

.htr

.msh

.wsh

.wsf

.vbe

.vb

.shs

.scf

.scr

.msp

.mst

.isp

Many thanks,

John

Highlighted
Not applicable

I'd like to add .xap files.  Silverlight uses these.

Highlighted
L4 Transporter

Charles,

Thanks for the suggestion. Can you tell me how controlling xap files differs from controlling silverlight as an application via App-ID?

Alfred

Highlighted
L0 Member

Hi Alfred,

I have noticed the file transfer blocking doesn’t work as expected. If a rule is in place blocking any file transfer using gmail or any other web-mail (Gmail not GTALK file transfer), it doesn’t work for file-types apart from the once mentioned in the list e.g. .TXT, .PCAP etc. If I select "ANY" as an option, that should block any attachments irrespective of the file-type or the extension. Even if PAN NGFW manages to block it, using a classic uploader option on gmail, the file goes right through. This is just a matter of checking a check-box on the settings page of the Gmail account, which an end user can easily do. I have tried the same with multiple web mails, attachment blocking doesn’t work for non listed file types, when the file type is selected as “ANY” in the file blocking profile.

Any advice would be appreciated.

Regards,

Sumukh Rao

Highlighted
L4 Transporter

Hi Sumukh,

As I told you, any means any of the below file types. It is a bit misleading.

Jones

Highlighted
L6 Presenter

Enclosed is a custom appID to detect for .jpg images.  The signature is looking for the end of the URI path and matching on  the string ‘\.jpg HTTP’ without the quote.  This will work for web-browsing apps only, and a typical web request would look like this:

GET .../images/twitter_corp.jpg HTTP/1.1\r\n

GET .../pictures/logo.jpg HTTP/1.1\r\n

You can import this appID into the PAN device under Objects ==> Application.  Once verified, you can clone the app and change the app signature to match other file types like .scr, .pif, etc.

Highlighted
Not applicable

Are you decrypting the Gmail session so that the PA unit can actually see the upload?

Tariq

Highlighted
L2 Linker

Hi,

 

Is there any update on blocking the below list of file types please?

 

Thanks,

Kate.

KK
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!