Tips & Tricks: Multi-Level Encoding and Blocking (File Blocking Profile)

Before PAN-OS 7.0, the Palo Alto Networks firewall was able to decode up to two levels of encoding. Files exceeding this level would be allowed to bypass file blocking. Since PAN-OS 7.0, the maximum level of decoding has been increased to 4.

Examples of encoding levels:

• Word document (docx) in a zip file sent by email defines three levels of encoding
• Word document (docx) zipped and sent through HTTP chunk encoding and gzip compression defines four levels of encoding

Up to and including PAN-OS 6.1.x, the way to prevent abuse of layers of encoding is to block the file types:

Starting from PAN-OS 7.0.x, these file types can be allowed to pass through while any files hidden in more levels of encoding can be blocked using Multi-Level-Encoding as a File Type in a File Blocking Profile:

See also

For more information, see also Tips from the Field: File blocking profile.