A Security policy can include specification of a file blocking profile that blocks selected file types from being uploaded or downloaded, or generates an alert when the specified file types are detected.
To apply file blocking profiles to security policies, refer to Policies > Security.
The following tables describe the file blocking profile settings.
File Blocking Profile Setting Description
Name Enter a profile name (up to 31 characters). This name appears in the list of file blocking profiles when defining security policies. The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores.
Description Enter a description for the profile (up to 255 characters).
Shared Select this option if you want the profile to be available to: Every virtual system (vsys) on a multi-vsys firewall. If you clear this selection, the profile will be available only to the Virtual System selected in the Objects tab. Every device group on Panorama. If you clear this selection, the profile will be available only to the Device Group selected in the Objects tab.
Disable override ( Panorama only ) Select this option if you want to prevent administrators from creating local copies of the profile in descendant device groups by overriding its inherited values. This selection is cleared by default, which means overriding is enabled.
Rules Define one or more rules to specify the action taken (if any) for the selected file types. To add a rule, specify the following and click Add: Name —Enter a rule name (up to 31 characters). Applications —Select the applications the rule applies to or select any. File Types —Click in the file types field and then click Add to view a list of supported file types. Click a file type to add it to the profile and continue to add additional file types as needed. If you select any, the defined action is taken on all supported file types. Direction —Select the direction of the file transfer ( Upload, Download, or Both). Action —Select the action taken when the selected file types are detected: alert —An entry is added to the threat log. block —The file is blocked. continue —A message to the user indicates that a download has been requested and asks the user to confirm whether to continue. The purpose is to warn the user of a possible unknown download (also known as a drive-by-download) and to give the user the option of continuing or stopping the download. When you create a file blocking profile with the action continue, you can only choose the application web-browsing. If you choose any other application, traffic that matches the Security policy will not flow through the firewall due to the fact that the users will not be prompted with a continue page.

Related Documentation