Large File download emulation responses

[NorthernNetGuy]

With the 100mb file limit on file emulation, we're left with fail open or fail close for anything that exceeds that.

So if a file is larger than the limit, and it's fail open, we're essentially assuming the file is safe in fail-open?

Fail close would lead to tickets where users may need to download larger files. Manual emulation would need to be performed to investigate the file further, which isn't very scalable. 

I want to know how others handle this policy, and what systems you may have in place for dealing with large file downloads.

[Lesley]

I think it is best to block large files. That is the best for security. If you going to scan large files the performance is also impacted on the firewall. Note there is also cache on the gateway so same files should not go again via scanning. 

I think 100mb is still the limit for this blade: https://support.checkpoint.com/results/sk/sk183425