Description
This article describes how the 'File filter' is used to block files passing through a FortiGate based on file type.
File filtering profile is based on file type (file's metadata) only, and not on file size or file content.
Example: When downloading a file with the 'exe' extension which is not a real 'exe' file, the file filter will not detect this file as a '.exe' file while configuring the file type 'exe'.
It is necessary to configure a DLP sensor to block files based on size or content such as SSN numbers, credit card numbers, etc.
Sometimes, it is necessary to exempt a particular file that is already a part of a file type that is blocked by a File filter.
For example, allow a specific .exe file while all other .exe files should be blocked.
However, the File filter exception option is not configurable.
Scope
All FortiOS versions.
Solution
Web filter can be used instead to achieve file filter exception.
- Create a file filter that blocks 'exe' file type:
Select Security Profiles -> File Filter.
(In FortiOS versions before 6.4.1, the File filter is configurable under the web filter profile).
To create a File filter in these instances, refer to Technical Tip: How to use file filtering.
- Add this file filter profile to the required firewall policy. Enable SSL inspection as 'deep-inspection':
Note: Verify that the destination address should not be in the exemption list of the deep inspection profile so that traffic will be inspected by FortiGate.
- Now, when any 'exe 'file type is attempted to be downloaded, the file filter will block it as follows:
On 'Download', the following block page will be shown:
The file has been blocked due to its file type and/or properties
- Since an exception is not possible to create in the same file filter profile, a web filter can be utilized.
Select Security Profiles -> Web Filter -> Static URL Filter, enable URL Filter, and create a wildcard entry as follows:
URL: *xxx.com <- Website from which the .exe file will be downloaded (In this example, a wildcard entry as '*image-line.com' is necessary).
Type: Wildcard.
Action: Exempt.
Status: Enable.
- Add this web filter profile ('Test') to the firewall policy making use of the file filter as follows:
- Now. while attempting to download the 'exe' file, it will be allowed:
