Configuring File Decompression

The FW supports filtering a decompressed file based on file content. You can set the decompression layers and the size of a decompressed file. The FW can process oversized decompression files and the files with multiple decompression layers.

Context

The FW detects compressed file by flow and implements decompression and content security detection simultaneously. If a data flow contains threat information, the FW processes the flow based on the content security configuration. If the data flow is secure and the decompression depth of a file or file size exceeds the specified value, the FW will take the action for the situation in which the maximum decompression depth or the maximum file size is exceeded:

Allow: Allows the file transfer. This is the default action.
Alert: Allows the file transfer and generates a log.
Block: Blocks the file transfer and generates a log.

Because the device does not support the block action for NFS, if the application is NFS and the action is block, the device will take the alert action.
If the application is IMAP or POP3 and the action is block, the device will delete attachments.

Procedure

Choose Object > Security Profiles > Global Configuration.

In File Decompression, set file decompression parameters and response actions.

Parameter	Description
Maximum layers	Maximum decompression layers supported by the FW By default, the maximum number of decompression layers is 3.
Action	Action that the FW will takes when the number of decompressed layers is greater than Maximum layers The default action is allow for the files exceeding the specified maximum decompression layers.
Maximum File Size	Maximum file size that the FW can decompress By default, the maximum file size is 100 MB. For the compressed files in 7ZIP and RAR formats, the maximum decompression file size of the USG6510E/6510E-POE is 1M, and the maximum value of this parameter can only be set to 1M. The default maximum decompression file size of other models except the preceding models is 10M, and the maximum value of this parameter can only be set to 10M.
Action	Action that the FW will takes when the file size exceeds Maximum File Size The default action is allow when the maximum file size is exceeded.

Click Commit.
The configuration does not take effect immediately after you modify the File Decompression. You must click Commit to apply the configuration. To save time, you can commit the configuration after all operations on the configuration file and all global configurations are complete.