Tips & Tricks: Multi-Level Encoding and Blocking (File Blocking Profile)

Tips & Tricks: Multi-Level Encoding and Blocking (File Blocking Profile)

29993
Created On 09/25/18 18:55 PM - Last Modified 07/13/20 19:49 PM


Resolution

Before PAN-OS 7.0, the Palo Alto Networks firewall was able to decode up to two levels of encoding. Files exceeding this level would be allowed to bypass file blocking. Since PAN-OS 7.0, the maximum level of decoding has been increased to 4.

 

Examples of encoding levels:

  • Word document (docx) in a zip file sent by email defines three levels of encoding
  • Word document (docx) zipped and sent through HTTP chunk encoding and gzip compression defines four levels of encoding

 

Up to and including PAN-OS 6.1.x, the way to prevent abuse of layers of encoding is to block the file types:

2016-06-21_14-13-20.jpg

 

Starting from PAN-OS 7.0.x, these file types can be allowed to pass through while any files hidden in more levels of encoding can be blocked using Multi-Level-Encoding as a File Type in a File Blocking Profile:

 

2016-06-21_14-04-10.jpg

 

See also

For more information, see also Tips from the Field: File blocking profile



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRjCAK&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language