Whitelist Files in Threat Prevention

[Oliver_222]

Can you please tell me what the whitelist files in the Threat Prevention policies is for?

The firewall is blocking a zip file by antivirus blade.
We tried adding the MD5 hash of the file to the whitelist, but the blocking still happens.

I might be wrong somewhere. Can you tell me what might be the problem with this locking?

[PhoneBoy]

Version/JHF?
What blades are active on the gateway?
Screenshots of all relevant logs (with sensitive details redacted)?

[Oliver_222]

R81.10 / Take 81

# enabled_blades
fw vpn cvpn urlf av appi ips identityServer SSL_INSPECT anti_bot ThreatEmulation content_awareness mon

 

 

[PhoneBoy]

The file type is blocked per your log card, which means it doesn't matter what the MD5 is.
You will need to create an exception similar to: https://support.checkpoint.com/results/sk/sk137812 

[Oliver_222]

I don't quite understand the phrase "it doesn't matter what the MD5 is". What is the reason for this behavior?
We are configured according to "Method B: Allow for only the specific files." sk137812