Problem with File blocking

[AKabary]

Hi all

i need to prevent all downloads on a network using Palo alto without affecting browsing

i created a file blocking profile , denied all extentions in the download direction and applied it in a policy

but iam still able to download many  exe and jpeg for example

i dont have a decryption policy in place
is it necessery ??

[BPry]

@AKabary,

In this case it would be since you need visibility into the traffic to see what's actually being done. If you take a look at what you've been able to download you'll likely see all of the traffic getting identified as 'ssl'; since you aren't decrypting this traffic the firewall can't see what your client is downloading. 

[AKabary]

OK i made the decryption policy and downloads are blocked
But zip files some how escape the block and download