Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 

Block .exe file download

Jump to solution

I got the queries, if it is possible to implement a policy which block the client from downloading the executable(exe) files in  checkpoint.

Our client were using fortinet 200D where we found such policy. So, we need to make that same policy to checkpoint.

Regards,

Sagar Manandhar

1 Solution

Accepted Solutions
Admin
Admin

Refer to the following SK: How to block any File Type Family to Anti-Virus scan in R77.XX 

These instructions should also apply for R80.x as well.

View solution in original post

13 Replies
Admin
Admin

Refer to the following SK: How to block any File Type Family to Anti-Virus scan in R77.XX 

These instructions should also apply for R80.x as well.

View solution in original post

i did it. but it is not working. ?

0 Kudos
Reply

from what i know AV blade check only file extension and not the MimeType of the file

0 Kudos
Reply

How does customers add this specific the file type families. is it possible for customer

0 Kudos
Reply

yes.

Starting with R80.10 this could also be achieved by using the new Content Awareness features. So there would be no need for an Anti-Virus license (NGTP bundle), but an NGFW bundle would be sufficient.

0 Kudos
Reply

simply create this rule:

How to enable Content Awareness:

1. Make sure you have an R80.10 Gateway

2. Edit the gateway and enable the Content Awareness blade.

3. Edit the current security policy layer and enable the Content Awareness blade.

4. The new "Content" column will show up in the rulebase.

Admin
Admin

I wish I could mark both our solutions as correct in Jive Smiley Happy

Collaborator

For my own clarity, this seems to work with both HTTP and HTTPS in my lab.  I am not doing HTTPS inspection, can I ask how this works with HTTPS?  My assumption was that I'd still be able to download an EXE, but I was wrong.  I don't know too much about Content Awareness possibilities, but it is intriguing.

Yeah. So if you have lower version than R80.10. You can achieve it by  Antivirus blade as well as DLP blade.

0 Kudos
Reply
Advisor

Guys,

correct me If I am wrong, for activation Content Awareness blade, I need DLP license which is not part of NGFW nor NGTP/TX bundle.

0 Kudos
Reply
Contributor

Trying to configure a Content Awareness rule for this scenario.

I have an inline rule configured for web browsing (rule 17):

I have more detailed inline rules below this (rule 17.x)

I wish to create content awareness checks at the lower levels of the inline rule but the Content column is greyed out?

R80.20 SM Admin Guide shows that this should be possible.

0 Kudos
Reply