topic Re: Threat Emulation: File exceeded size limit in SASE and Remote Access

Threat Emulation: File exceeded size limit

cryptochrome — Mon, 11 Sep 2023 15:30:29 GMT

Hello,

we are testing Harmony Connect right now and we can't download larger files. Looking into the logs, I find a "File exceeded size limit" error message, coming from the Threat Emulation blade. It's in the "detect" category.

I don't see an option anywhere to control this behavior. What's the best approach here? My workaround was to exclude the sites from SSL inspection, which does work, of course. But that shouldn't have to be the solution.

I would have expected an option to fine tune the blade configurations, but all I see is a profiles page with zero options to change anything.

Thanks

Re: Threat Emulation: File exceeded size limit

PhoneBoy — Mon, 11 Sep 2023 17:46:20 GMT

On our regular Quantum gateways, the default limit for emulation is 15mb and can be adjusted to, I believe, 100mb.
Possible the TAC may be able to assist with this: https://help.checkpoint.com

Re: Threat Emulation: File exceeded size limit

cryptochrome — Mon, 11 Sep 2023 22:36:42 GMT

Thanks. What puzzles me is that there seems to be no way at all to influence this. I can't even tell it to skip files larger than the limit. It just blocks them - with no notice to the user (increasing ticket load).

I was hoping maybe someone from Check Point reads this and share some comments.

Re: Threat Emulation: File exceeded size limit

PhoneBoy — Mon, 11 Sep 2023 22:40:00 GMT

The TAC may actually have to make the configuration change on your behalf.

Re: Threat Emulation: File exceeded size limit

the_rock — Mon, 11 Sep 2023 23:17:18 GMT

I believe one of our customers had this issue and it needed TAC case, so support could fix this for them on back end.

Andy