Focus

PAN-OS Web Interface Reference

Objects > Security Profiles > File Blocking

Table of Contents

Objects > Security Profiles > File Blocking

You can attach a File Blocking profile to a Security policy rule (Policies > Security) to block users from uploading or downloading specified file types or to generate an alert when a user attempts to upload or download specified file types.

For the best security, apply the predefined strict profile. If you need to support critical applications that use a file type which the strict profile blocks, clone the strict profile and make only the file type exceptions you need. Apply the cloned profile to a Security Policy rule that restricts the exception to only the sources, destinations, and users that need to use the file type. You can also use Direction to restrict the exception to uploading or downloading.

If you don’t block all Windows PE files, send all unknown files to WildFire for analysis. For user accounts, set the Action to continue to help prevent drive-by downloads where malicious web sites, emails, or pop-ups cause users to inadvertently download malicious files. Educate users that a Continue prompt for a file transfer they didn’t knowingly initiate may mean they are subject to a malicious download.

The following tables describe the file blocking profile settings.

File Blocking Profile Settings	Description
Name	Enter a profile name (up to 31 characters). This name appears in the list of file blocking profiles when defining security policies. The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores.
Description	Enter a description for the profile (up to 255 characters).
Shared (`Panorama only`)	Select this option if you want the profile to be available to: Every virtual system (vsys) on a multi-vsys firewall. If you clear this selection, the profile will be available only to the Virtual System selected in the Objects tab. Every device group on Panorama. If you clear this selection, the profile will be available only to the Device Group selected in the Objects tab.
Disable override (`Panorama only`)	Select this option to prevent administrators from overriding the settings of this File Blocking profile in device groups that inherit the profile. This selection is cleared by default, which means administrators can override the settings for any device group that inherits the profile.
Rules	Define one or more rules to specify the action taken (if any) for the selected file types. To add a rule, specify the following and click Add: Name—Enter a rule name (up to 31 characters). Applications—Select the applications the rule applies to or select any. File Types—Click in the file types field and then click Add to view a list of supported file types. Click a file type to add it to the profile and continue to add additional file types as needed. If you select Any, the defined action is taken on all supported file types. Direction—Select the direction of the file transfer (Upload, Download, or Both). Action—Select the action taken when the selected file types are detected: alert—An entry is added to the threat log. continue—A message to the user indicates that a download has been requested and asks the user to confirm whether to continue. The purpose is to warn the user of a possible unknown download (also known as a drive-by-download) and to give the user the option of continuing or stopping the download. When you create a file blocking profile with the action continue, you can only choose the application web-browsing. If you choose any other application, traffic that matches the Security policy rule will not flow through the firewall due to the fact that the users will not be prompted with a continue page. block—The file is blocked.

HTTP Header Insertion

Objects > Security Profiles > WildFire Analysis