Help with file blocking security profiles

[W.Chin117351]

Hello everyone, 

Let me say I am new to the live community,  I am trying to figure out if possible to Block file downloads using the "File download" security profile.  I enabled it added it to my in to out policy and it still downloaded the files.  After doing some more research I found out that the "Allow HTTP partial response" is enable it will download files.  If I disable that setting it will affect streaming media i.e youtube, zoom, teams video, and I also heard Microsoft updates OS and O365.  Does anyone have a way to secure downloading files and not affect the other items or ideas.   Much appreciated.  Winston

[TomYoung]

Hi @W.Chin117351 ,

In the traffic logs, what application is used to download the file?

Thanks,

Tom

[W.Chin117351]

Tom, 

I will need to look again and see.  I have that option still enabled because of streaming media and I don't want to break updates.   I was using the web browser and clicking download, so, it just completed the download like normal.    I hope this makes sense??  Much appreciate your input.  Winston

[TomYoung]

Hi @W.Chin117351 ,

I am asking you to find the specific session of the download under Monitor > Logs > Traffic, and then tell me what application is listed under the APPLICATION column.

Thanks,

Tom

[W.Chin117351]

Hello Tom, 

Apologize for the delay in response.  Under application it is ssl.

Thx, 

Winston

[TomYoung]

Hi Winston,

Thank you for your reply!  File blocking will not work with SSL because it is encrypted.  The NGFW cannot look inside the packets to see the file.  File blocking will work with SSL if you enable SSL Decryption on the NGFW.

https://docs.paloaltonetworks.com/best-practices/10-1/decryption-best-practices

Thanks,

Tom