How to block .zip file without blocking files office 2010?

Forum|Forum|10 years ago
March 7, 2016
3 replies
6748 views

Good Morning. I own FortiGate 90D with firmware Version v5.2.3, build 670. I have a problem I can not block DLP * .zip, because it blocks Microsoft Office files (* .xlsx, * .docx). How do I block incoming emails with .zip extension without locking office extensions 2010?

Thank you!

netmin

New Member

This is a bit more difficult, since x-files such as docx, xlsx and pptx are structured zip files as well.

A potential workaround is a regex like this: ^PK\x03\x04(?!.{26}\[Content_Types\]\.xml)

...which triggers the PK-ZIP magic bytes "not followed by 'any' 26 bytes + [Content_Types].xml" - when assuming that the first file inside the MS Office documents is always "[Content_Types].xml"