web file blocking

[Deepa_D]

Hello Community,

We are trying to implement file upload/download blocking for W-Web in our environment using a Palo Alto firewall.

Current setup:

SSL Forward Proxy decryption is enabled.

A decryption certificate has been created on the firewall and installed in the Trusted Root Certification Authorities store on client machines.

Security policy and File Blocking profile are configured to block file transfers for watsapp Web.

Issue observed:
Even after installing the firewall decryption certificate on the client machines, Wtsup Web continues to present the official Wtsapp certificate chain when verified from the browser. The firewall certificate is not being applied.

Questions:

Does Watsup Web use certificate pinning, which prevents SSL Forward Proxy decryption?

Is SSL Inbound Inspection or any additional SSL/TLS profile required for Wtsup Web file blocking?

Is it possible to block file transfers for Wtsup Web without SSL decryption, using App-ID or Content-ID?

Are there any known Palo Alto limitations or recommended best practices for Wtsup Web file blocking?

Any guidance or real-world experience on this would be greatly appreciated.

Thank you in advance for your support.

[Deepa_D]

 I have not used a decryption profile or anything similar. I just created a policy that allows Wtsapp-base, Wtsapp-chat, and Wtsapp-voice. Initially, I can see that Wtsapp upload and download are blocked, but if I click ‘try again’, I can upload the file. At first it is denied, but if I try again, the file transfer succeeds. Could someone please provide a solution if you are using this in your organization or have tried it in your lab and succeeded?