|Description||This article describes why the '.dll'(Dynamic Link Library) file is blocked in the archive file when execute file (.exe) is configured as block in the file-filter.|
The file filter is set to block '.exe' file only.
# config file-filter profile
However, some archive-file types like cabinet (.cab) are blocked.
The security event log shows the followings:
date=2023-01-06 time=03:36:55 eventtime=1672947415497679921 tz="+0800" logid="1900064000" type="utm" subtype="file-filter"
The cab file is blocked is due to 'DolbyAccessAddin.18.104.22.168.cab' containing multiple files and one of the files is 'DolbyAccessAddin.dll', which is an executable file.
To avoid the FortiGate to scan the archive, or prevent this file to block, it is possible to use 'set scan-archive-contents disable'.