Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Sagar_Manandhar
Advisor
Jump to solution

Block .exe file download

I got the queries, if it is possible to implement a policy which block the client from downloading the executable(exe) files in  checkpoint.

Our client were using fortinet 200D where we found such policy. So, we need to make that same policy to checkpoint.

Regards,

Sagar Manandhar

1 Solution

Accepted Solutions
PhoneBoy
Admin
Admin

Refer to the following SK: How to block any File Type Family to Anti-Virus scan in R77.XX 

These instructions should also apply for R80.x as well.

View solution in original post

13 Replies
PhoneBoy
Admin
Admin

Refer to the following SK: How to block any File Type Family to Anti-Virus scan in R77.XX 

These instructions should also apply for R80.x as well.

dorj_erdeneochi
Explorer

i did it. but it is not working. ?

0 Kudos
Dor_Marcovitch
Advisor

from what i know AV blade check only file extension and not the MimeType of the file

0 Kudos
dorj_erdeneochi
Explorer

How does customers add this specific the file type families. is it possible for customer

0 Kudos
Tomer_Sole
Mentor
Mentor

yes.

Norbert_Bohusch
Advisor

Starting with R80.10 this could also be achieved by using the new Content Awareness features. So there would be no need for an Anti-Virus license (NGTP bundle), but an NGFW bundle would be sufficient.

0 Kudos
Tomer_Sole
Mentor
Mentor

simply create this rule:

How to enable Content Awareness:

1. Make sure you have an R80.10 Gateway

2. Edit the gateway and enable the Content Awareness blade.

3. Edit the current security policy layer and enable the Content Awareness blade.

4. The new "Content" column will show up in the rulebase.

PhoneBoy
Admin
Admin

I wish I could mark both our solutions as correct in Jive Smiley Happy

Kevin_Vargo
Collaborator

For my own clarity, this seems to work with both HTTP and HTTPS in my lab.  I am not doing HTTPS inspection, can I ask how this works with HTTPS?  My assumption was that I'd still be able to download an EXE, but I was wrong.  I don't know too much about Content Awareness possibilities, but it is intriguing.

Gaurav_Pandya
Advisor

Yeah. So if you have lower version than R80.10. You can achieve it by  Antivirus blade as well as DLP blade.

0 Kudos
Martin_Raska
Advisor
Advisor

Guys,

correct me If I am wrong, for activation Content Awareness blade, I need DLP license which is not part of NGFW nor NGTP/TX bundle.

0 Kudos
Pedro_Silva
Contributor

Trying to configure a Content Awareness rule for this scenario.

I have an inline rule configured for web browsing (rule 17):

I have more detailed inline rules below this (rule 17.x)

I wish to create content awareness checks at the lower levels of the inline rule but the Content column is greyed out?

R80.20 SM Admin Guide shows that this should be possible.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events