topic Re: Mobile Access Portal + other blades? in SASE and Remote Access

Mobile Access Portal + other blades?

Rafal_N — Wed, 13 Feb 2019 11:06:29 GMT

Hi,

I try to scan files that are uploaded using Mobile Access Portal - File Shares, Web Applications but it looks like that all other security blades (AV,TE) ignores them. I triple check my TP policy and it seems to be ok.

Does anybody can confirm that it should work and there is something in my configuration or is it something that gateway can't do at all.

Re: Mobile Access Portal + other blades?

PhoneBoy — Thu, 14 Feb 2019 04:59:04 GMT

All the blades are supposed to work with Mobile Access Blade as noted in the documentation.

How are you determining that the blades are "ignoring" files uploaded via file shares?

Note the blades usually don't generate a log unless a file is malicious.

Re: Mobile Access Portal + other blades?

Rafal_N — Fri, 15 Feb 2019 14:32:38 GMT

I'm uploading malware test file "eicar.com" that gateway normally recognized without issue. Only when I transfer it using Mobile Access Portal it doesn't work. I thought it was only for Fileshare (some CIFS issue) but i add web aplication using http (not https) and file isn't scan at all.

Re: Mobile Access Portal + other blades?

PhoneBoy — Fri, 15 Feb 2019 19:51:47 GMT

EICAR is kind of a special case

As there have been a few false positives with EICAR, and it's not really malicious, we don't detect EICAR by default.

Execute the following command on the gateway: fw ctl set int g_ci_av_eicar_handling_mode 2

Then repeat your test.

Re: Mobile Access Portal + other blades?

Rafal_N — Mon, 18 Feb 2019 13:08:07 GMT

I have set it to 2 previous it was set to 0. g_ci_av_eicar_handling_mode = 2

But changing this setting doesn't help. Eicar is and was recognized if i download it form web site but if i uploaded it using Mobile Access Portal interface it doesn't.

Even if I establish tunnel (IPSEC or SSL/Connect) and uploading eicar file to web application it is blocked as it should.

If I open Mobile Access Portal and without tunnel open that same web application only define as http URL in portal it is passed without scan.

Re: Mobile Access Portal + other blades?

PhoneBoy — Tue, 19 Feb 2019 08:33:42 GMT

Recommend opening a TAC case so we can investigate this more closely.

How To Open a Case with TAC and/or Account Services‌

Re: Mobile Access Portal + other blades?

Rafal_N — Tue, 19 Feb 2019 09:04:14 GMT

I got statements, that Traditional AV and Anti-Virus is not supported with Mobile Access portal. So probably TE does not work either. It should be write red capital letters in documentation in Mobile Access Portal.

I try to figure out some workaround how to solve it because it is big surprised for me. Any ideas and suggestion will be nice.

Re: Mobile Access Portal + other blades?

PhoneBoy — Sat, 23 Feb 2019 14:23:48 GMT

Please send me the TAC SR in a private message.

The documentation explicitly contradicts this, so I'd like to get to the bottom of it.