Block .exe file download

[Sagar_Manandhar]

I got the queries, if it is possible to implement a policy which block the client from downloading the executable(exe) files in  checkpoint.

Our client were using fortinet 200D where we found such policy. So, we need to make that same policy to checkpoint.

Regards,

Sagar Manandhar

[PhoneBoy · Accepted solution]

Refer to the following SK: How to block any File Type Family to Anti-Virus scan in R77.XX 

These instructions should also apply for R80.x as well.

[dorj_erdeneochi]

i did it. but it is not working. ?

[Dor_Marcovitch]

from what i know AV blade check only file extension and not the MimeType of the file

[dorj_erdeneochi]

How does customers add this specific the file type families. is it possible for customer

[Tomer_Sole]

yes.

[Norbert_Bohusch]

Starting with R80.10 this could also be achieved by using the new Content Awareness features. So there would be no need for an Anti-Virus license (NGTP bundle), but an NGFW bundle would be sufficient.

[Tomer_Sole]

simply create this rule:

How to enable Content Awareness:

1. Make sure you have an R80.10 Gateway

2. Edit the gateway and enable the Content Awareness blade.

3. Edit the current security policy layer and enable the Content Awareness blade.

4. The new "Content" column will show up in the rulebase.

[PhoneBoy]

I wish I could mark both our solutions as correct in Jive

[Kevin_Vargo]

For my own clarity, this seems to work with both HTTP and HTTPS in my lab.  I am not doing HTTPS inspection, can I ask how this works with HTTPS?  My assumption was that I'd still be able to download an EXE, but I was wrong.  I don't know too much about Content Awareness possibilities, but it is intriguing.

[Gaurav_Pandya]

Yeah. So if you have lower version than R80.10. You can achieve it by  Antivirus blade as well as DLP blade.

[Martin_Raska]

Guys,

correct me If I am wrong, for activation Content Awareness blade, I need DLP license which is not part of NGFW nor NGTP/TX bundle.

[Norbert_Bohusch]

Wrong! NGFW is enough, see here:

https://community.checkpoint.com/docs/DOC-2052-infinity-r8010-cool-feature-of-the-day-content-awaren...

[Pedro_Silva]

Trying to configure a Content Awareness rule for this scenario.

I have an inline rule configured for web browsing (rule 17):

I have more detailed inline rules below this (rule 17.x)

I wish to create content awareness checks at the lower levels of the inline rule but the Content column is greyed out?

R80.20 SM Admin Guide shows that this should be possible.