Configuring File Blocking

Procedure

1. Choose Object > Security Profiles > File Blocking.
2. Click Add in File Blocking Profile List tab.
3. Set the name and description of a file blocking profile.

   Parameter	Description
   Name	Name of a file blocking profile. The name must be unique. The name is displayed in the parameter list of file blocking during the configuration of security policies.
   Description	Description of the file blocking profile. The description helps the administrator understand the functions of the file blocking profile and maintain the profile. For example, a description could be "Blocks the download of .exe files through FTP".

4. Configure file blocking rules.
   1. Click Add in File Blocking Rules.
   2. Set the name of a file blocking rule.

      Parameter	Description
      Name	Name of a file blocking rule. The name must be unique.

   3. Configure matching conditions for the file blocking rule.

      The device compares the file attributes with the matching conditions of a rule. If all conditions are matched, the device implements the action defined in the rule. If one condition is not met, the device matches the file attributes with the next rule. If no rule is matched, the device allows the file transfer.

      If the device identifies the file type, the matching conditions of file blocking are application, file type, and direction.

      If the device cannot identify the file type, the matching conditions of file blocking are application, user-defined file name extension, and direction.

      Parameter	Description
      Application	Application protocol of files to be filtered. For example, you can select FTP to filter the files transferred over FTP.
      File Type	Type of files to be filtered. File type is the actual file type identified by the device.
      File Extension	User-defined file name extension is supplementary to the file type. If the file type cannot be identified, the device implements file blocking by user-defined file name extension.
      Direction	Transfer direction of files to be filtered. The direction can be: Upload Download Both

      

      You must determine the types of files to be filtered and choose the types from the drop-down list. If the types are not included in the list, you must add the file types in File Extension.

      For example, if you want to block .exe, .doc, and .flv files, but .flv does not exist in the drop-down list, you can choose .exe and .doc from the drop-down list and configure .flv as a user-defined name extension.

   4. Configure the action for the file blocking rule.
      

      • Because the device does not support the block action for NFS , the device takes the alert action when Application is set to NFS, and Action is set to Block.

      • The device deletes the attachment if Application is set to IMAP or POP3 and Action is set to Block.

      Parameter	Description
      Action	If all conditions are matched, the device implements either of the following actions: Block: blocks the file transfer and generates a log. Alert: allows the file transfer and generates a log. This is the default action. Allow: allows the file transfer. A DSCP priority can be set for a transferable file.
      DSCP Priority Re-marking	It is configured when the action is set to Allow. Setting DSCP priorities for files by file severity improves file transfer quality.

   5. Click OK.
   6. Repeat steps a to e to create multiple file blocking rules.
5. Click OK. The configuration of the file blocking profile is complete.
6. Reference file blocking profiles in security policies. For details on how to configure security policies, see Configuring a Security Policy Using the Web UI.
7. Click Commit on the upper right of the interface to commit the profile.

   The configuration does not take immediate effect after you create or modify the profile. You must click Commit on the upper right of the interface to activate the configuration. To save time, you can commit the configuration after all operations on the profile are complete.