how to prevent large file from downloading only

[amrshawky]

i make DLP sensor and map it with a policy to prevent download files large than 500M after apply, user can not download small or large files

[OneOfUs]

Please provide the output of your sensor from the CLI:  

config dlp sensor

    edit "Large-File"

        config filter

            edit 1

                set name "Large-File-Filter"

                set proto smtp pop3 imap http-get http-post mapi

                set filter-by file-size

                set file-size 51240

                set action log-only

            next

        end

    next

end

 https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-security-profiles/DLP/DLP%20examples...   You can also watch to flows to get a better idea why it's failing:   diagnose debug reset diagnose debug enable diagnose debug flow show console enable diagnose debug flow filter addr <source ip> diagnose debug flow trace start 100   To stop the debug: diagnose debug disable diagnose debug reset

[nbctcp]

QUESTIONS: 1. since 6.2 DLP disappear from menu. What is alternative method to limit download size 2. will that "debug flow" work in proxy mode? tq

[Dave_Hall]

The patch notes only says DLP can only be configured via the CLI.  That to me says it was only removed from the GUI. 

[nbctcp]

I have tried on cli many times. You can create sensor but can't apply to policy

[CAD · Accepted solution]

 activate  (Block Oversized File/Email) in porxy option 

     

[nbctcp]

@CAD

Haven't tested but I think you are right

https://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-security-profiles/Proxy_Options/Prox...

The location is in Security Profiles/Proxy Options/

But I think that is Global Settings.

Let say I want Director Group have 100MB limit and Staff Group 50MB limit

Is that possible?

[CAD]

yes, just create profile for each group and assign to fwpolicy.