Tips & Tricks: Multi-Level Encoding and Blocking (File Blocking Profile)

Tips & Tricks: Multi-Level Encoding and Blocking (File Blocking Profile)

Created On 09/25/18 18:55 PM - Last Modified 07/13/20 19:49 PM


Before PAN-OS 7.0, the Palo Alto Networks firewall was able to decode up to two levels of encoding. Files exceeding this level would be allowed to bypass file blocking. Since PAN-OS 7.0, the maximum level of decoding has been increased to 4.


Examples of encoding levels:

  • Word document (docx) in a zip file sent by email defines three levels of encoding
  • Word document (docx) zipped and sent through HTTP chunk encoding and gzip compression defines four levels of encoding


Up to and including PAN-OS 6.1.x, the way to prevent abuse of layers of encoding is to block the file types:



Starting from PAN-OS 7.0.x, these file types can be allowed to pass through while any files hidden in more levels of encoding can be blocked using Multi-Level-Encoding as a File Type in a File Blocking Profile:




See also

For more information, see also Tips from the Field: File blocking profile

  • Print
  • Copy Link

Choose Language