Focus

Remote Browser Isolation

Configure File Transfer Controls for Remote Browser Isolation

Table of Contents

Supported File Types for Upload or Download in RBI

Configure File Transfer Controls for Remote Browser Isolation

Learn how to configure RBI to control which types of files users can transfer during isolated browsing sessions.

Where Can I Use This?	What Do I Need?
Strata Cloud Manager Managed Prisma Access	Minimum required Prisma Access version: 5.2.1 Innovation and Preferred Prisma Access license with the Mobile User or Remote Networks license subscription Remote Browser Isolation license

Remote Browser Isolation (RBI) provides protection by isolating web browsing activity from your local network. With file type controls for upload and download, you can add an additional layer of security by controlling which types of files users can transfer during isolated browsing sessions.

With file type controls, you can create more granular rules for file transfers in RBI, enabling you to:

Permit business-critical file transfers while blocking potentially malicious files
Create different policy rules for uploads versus downloads
Apply restrictions based on predefined file categories or custom file extensions

Rather than permitting all file types for uploads or downloads, or not permitting file transfers at all, you can now permit specific file categories while blocking others, based on your organization's security policies and business requirements.

Isolation profiles determine which RBI features and capabilities are available during isolated browsing sessions. You will configure file type-based restrictions at the isolation profile level, enabling you to create different file transfer policy rules for different use cases. You can select from predefined file extension categories, or create up to 50 custom file types to have even more granular control over which file types users can upload or download during isolated browsing sessions.

Before you begin, ensure that you configured RBI.

To configure an isolation profile to control which types of files users can transfer during isolated browsing sessions, complete the following steps:

Navigate to the isolation profile settings.
1. In Strata Cloud Manager, select ConfigurationNGFW and Prisma AccessConfiguration ScopeGlobalSetup and select the Remote Browser Isolation settings.
2. From the Remote Browser Isolation page, select Isolation Profiles.
3. Select an existing isolation profile to edit, or Add Isolation Profile to create a new profile.
Configure basic file transfer settings.
1. If configuring a new isolation profile, enter a Name for the profile.
2. In the Security Control section of the isolation profile, configure the basic file transfer controls:
  View Files in Isolation—Enable or disable viewing of the supported file types for viewing in RBI.
  
  If you enable this option, your users can view these files in an isolated browsing session even if you don't allow them to download the files in the File Extensions for Download section. Your users, however, can’t download these types of files in the isolated browsing session.
  
  Upload Files—Enable this option to permit file uploads from the local device to websites accessed through RBI. The default is Enabled.
  Download Files—Enable this option to permit file downloads from websites to the local device. The default is Enabled.
Configure upload file type restrictions.
1. In the File Extensions for Upload section, select one of the following options:
  To permit uploads of all file types, select Any. This setting is the default.
  To permit file types in specific categories, click Select and choose one or more Predefined Categories:
  Documents—Word-processing files, PDFs, spreadsheets, presentations, among others
  Multimedia—Images, audio, and video files
  Executables/Applications—Program files and application installers
  Archives—Compressed files like ZIP, TAR, 7Z, among others
  Source Code—Programming and web development files
  
  When you select a category, all the file types within the category are permitted for upload.
2. To add custom file extensions:
  Select Custom Categories.
  Enter one or more custom file extension (including the period, for example ".xsl") and click Enter. You can add up to 50 custom extensions. Separate each extension with a comma. Each file extension must not exceed six characters. For example:
Configure download file type restrictions in the File Extensions for Download section. Follow the same instructions as setting the file upload restrictions.
Save the profile.
If necessary, make changes to the URL Access Management profile and attach the isolation profile to it or update the security policy rule that uses the URL Access Management profile for isolation.
Push the configuration.
Verify your configuration is working properly.
1. Launch an RBI session using the configured isolation profile.
2. Test file uploads and downloads with various file types:
  Files matching allowed categories should transfer successfully.
  RBI should block files not matching allowed categories.
3. Check the system logs to verify that RBI allowed or blocked file transfers according to your policy rule.