Files blocking

[mazu74]

I have Fortigate 90D V5.2.

Two users failed to send and receive mail. One POP3 and one SMTP. Why ? and is it possible to retrieve attachment File.zip ? I dont know where is attachment File.zip ?

POP3 :

Message meets Alert condition File Block Detected: File.zip Protocol: POP3 Source IP: XX.XX.XX.XX Destination IP: YY.YY.YY.YY Email Address From: aaa@bbb.com Email Address To: bbb@ccc.com date=2014-12-02 time=08:34:30 devname=fg90D- devid=FGT90D3Z13010344 logid=0262008961 type=utm subtype=virus eventtype=scanerror level=notice vd="root" msg="File reached uncompressed size limit." action=blocked service=POP3 sessionid=73459023 srcip=XX.XX.XX.XX dstip=YY.YY.YY.YY srcport=51029 dstport=110 proto=6 direction=incoming filename="File.zip" quarskip=No-skip profile="default" from="aaa@bbb.com" to="bbb@ccc.com" analyticscksum="1a12eceb42c5c041c9e764b3c3eafc9f76a92b8e25a3db384bb76713d1cfc295" analyticssubmit=false  

SMTP : Message meets Alert condition File Block Detected: File.zip Protocol: SMTP Source IP: XX.XX.XX.XX Destination IP: YY.YY.YY.YY Email Address From: aaa@bbb.xom Email Address To: bbb@ccc.com date=2014-12-02 time=09:04:19 devname=fg90D- devid=FGT90D3Z13010344 logid=0262008961 type=utm subtype=virus eventtype=scanerror level=notice vd="root" msg="File reached uncompressed size limit." action=blocked service=SMTP sessionid=73489460 srcip=XX.XX.XX.XX dstip=194.2.0.81 srcport=51473 dstport=25 proto=6 direction=outgoing filename="File.zip" quarskip=No-skip profile="default" from="aaa@bbb.xom" to="bbb@ccc.com" sender="aaa@bbb.xom" recipient="bbb@ccc.com" analyticscksum="578f02aaac42123e95c24eb9e55bccf455085c9d2cd4d3ab742bfa752e7ef9d2" analyticssubmit=false

[neonbit]

I believe it may be something to do with your proxy 'uncompressed-oversized-limit' option.

Please confirm which proxy option you're using on your email profile, usually it will be the 'default' one. If you haven't changed the profile then the default value of 10MB is used. This means if a file comes through where the zipped content is 10MB or larger then it will be dropped.

For example below; I've got the default proxy configured to block oversized emails with a threshold of 10MB (attached pic). I then changed the uncompress-oversize-limit to 5MB (CLI below).

fortigate # config firewall profile-protocol-options
fortigate (profile-protocol~ons) # edit default
fortigate (default) # config smtp

fortigate (default) # set uncompressed-oversize-limit 5

fortigate (smtp) # get
ports : 25
status : enable
inspect-all : disable
options : oversize
oversize-limit : 10
uncompressed-oversize-limit: 5
uncompressed-nest-limit: 12
scan-bzip2 : enable
server-busy : disable

Now if I send a 4MB zip file that contains a 9MB pdf, it will get blocked because the uncompress limit is 5MB (and the file within the zip is 9MB).

The alert now shows me this block (which is like the alert you're seeing)

Message meets Alert condition File Block Detected: fortigate-cli-52.zip Protocol: SMTP Source IP: 1.1.1.1 Destination IP: 192.168.1.1 Email Address From: aaa@domain.com Email Address To: bbb@domain2.com date=2014-12-03 time=00:00:00 devname=fortigate devid=FGVM0100000000 logid=0262008961 type=utm subtype=virus eventtype=scanerror level=notice vd="root" msg="File reached uncompressed size limit." action=blocked service=SMTP sessionid=1259698 srcip=1.1.1.1 dstip=192.168.1.1 srcport=61973 dstport=25 proto=6 direction=outgoing filename="fortigate-cli-52.zip" quarskip=No-skip profile="smtp-proxy" from="aaa@domain.com" to="bbb@domain2.com" sender="aaa@domain.com" recipient="bbb@domain2.com" analyticscksum="47e9dc238778f935cc0fd69295ea2c6515adv035922ec026f06b5fd7900213ac" analyticssubmit=false crscore=100 crlevel=critical

[mazu74]

Really interesting ! Thanks   But in 5.2, i don't have "set uncompressed-oversize-limit". I found in http://docs-legacy.fortinet.com/cb/html/index.html#page/FOS_Cookbook/UTM/cb_utm_av_max_scan_size.htm...

config antivirus service smtp
set uncompsizelimit 50
end

config antivirus service pop3
set uncompsizelimit 50
end

config antivirus service http
set uncompsizelimit 50
end

 

[ede_pfau]

In v5.2, this is in Policy&Objects > Policy > Proxy Options, Common Options. Check 'Block Oversized File/Email' and enter a limit in MB.

If this option is not checked there used to be a log entry stating the oversize but with action=pass. No idea if this is still the case in v5.2.