Hello,
hope you're doing all well. We are in the process of evaluating the Check Point Threat Prevention Suite (against another solution) and we're stuck at Content Awareness right now.
We just wanted to test a very basic rule to block executable files but we get very strange results - some files doesn't get blocked at all or only sometimes. TLS Inspection is enabled and the browser is limited to TLS 1.2 as we heard it may cause problems if the browser tries 1.3 and Check Point doesn't support it currently (R80.40 JHF 89).
The rule looks like this:
![rule.PNG rule.PNG](https://community.checkpoint.com/t5/image/serverpage/image-id/10807i6392E2044C1004FA/image-size/large?v=v2&px=999)
The log entry looks like this when the file isn't blocked:
![redirect_2.png redirect_2.png](https://community.checkpoint.com/t5/image/serverpage/image-id/10808i238AAC63D5A9DB28/image-size/medium?v=v2&px=400)
We can cleary see that the connections is Inspected and also the Rule and Data Type gets recognized correctly but the download is still possible.
We already tried a different host, putting the rule out of the inline layer and many small other things. Do you have any suggestion how to troubleshoot and what could be wrong?