How to block csv files download by File-Blocking

[paloalto.netfos]

Hi All,

I just want to block csv files download by file-blocking, however I cann't find it in the file types.

Are there any ways to block it download?

Thanks,

Joy,

[rmonvon]

Hi...CSV is just plain text file with commas separating the fields.  The PA device should identify the csv file as text file.  Thanks.

[paloalto.netfos]

Hi rmonvon,

Thanks for your answers, but I have tried upload a .txt text file to gmail and no any log about it displayed in the Data-Filtering. I also cann't see text or txt file type in the file-blocking file type.

My test unit is PA-5020 and PANOS is 4.1.6-h1.

Thanks,

Joy,

[rmonvon]

My apology on the file blocking as we do not have a file type for .txt.  It would match many web contents since all web pages will have some text on them.  You could try defining a custom app signature to match .csv similar to the recommendation here to detect jpg and mp3:

For Data Filtering, we do have text/html as a file type to scan but Data Filtering is looking for a data pattern inside the file like credit card numbers.  You should also check to see if gmail is using SSL to encrypt the transfer as I believe it is.  You will have to enable SSL decryption on the PA5020 to inspect inside of SSL and scan the content for data patterns.

Thanks.

[paloalto.netfos]

Hi rmonvon,

Thanks for reply, and what is default behavior when file-booking detects unknown file type, ignores but logs it? ignores without logs? bypass without anything? blocks it but logs it? blocks it without logs?

Thanks,

Joy,

[rmonvon]

For unknown file types, the action would be bypass (allow) & no logging. 

[jwolach]

Are you decrypting the gmail traffic with a Forward-Proxy Rule?  If not, you will not see the file attachments because gmail is an encrypted application.

[jwolach]

I just modified the .JPG App-ID signature for .CSV.  Here it is.  Just import it into the Application Object and create a Block Security Policy.

[paloalto.netfos]

Hi Jwolach,

Yes, I do ssl forward-proxy in my unit, and I can see the traffic log of gmail, but Data-Filtering is not.

[paloalto.netfos]

Hi Jwolach,

Thanks for your sample, I will try it.

Regards,

Joy,