UTM bypass

In this example, UTM bypass is configured for Dropbox file downloading in the inline CASB profile.

To configure an inline CASB profile with UTM bypass in the GUI:

1. Configure the inline CASB profile:

   1. Go to Security Profiles > Inline-CASB and click Create new.

   2. Enter a Name, such as dropbox_test.

   3. In the SaaS Applications table, click Create new. The Create SaaS Application Rules pane opens.

   4. Set the Application to dropbox, then click Next.

      

   5. Enable Logging.

   6. In the Privilege Control table, select download-file and from the Set Action dropdown, select Bypass.

      

      The Bypass UTM Profile(s) pane opens.

   7. Click the + and set Profile(s) to File Filter.

      

   8. Click OK to save the bypass UTM profile.

   9. Click OK to save the inline CASB profile

2. Configure the firewall policy:

   1. Go to Policy & Objects > Firewall Policy. Edit an existing policy, or create a new one.

   2. Set the Inspection Mode to Proxy-based.

   3. In the Security Profiles section, enable Inline-CASB and select the dropbox_test profile.

   4. Set the SSL Inspection profile to one that uses deep inspection.

   5. Configure the other settings as needed.

   6. Click OK.

To configure an inline CASB profile with UTM bypass in the CLI:

1. Configure the inline CASB profile:

   config casb profile
       edit "dropbox_test"
           config saas-application
               edit "dropbox"
                   config access-rule
                       edit "dropbox-download-file"
                           set bypass file-filter
                           set action bypass
                       next
                   end
               next
           end
       next
   end

2. Configure the firewall policy:

   config firewall policy
       edit 9
           set name "casb_test_dropbox"
           set srcintf "port1"
           set dstintf "port3"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "ssl"
           set casb-profile "dropbox_test"
           set nat enable
       next
   end

To test the configuration:

1. Open a browser and log in to Dropbox.

2. Attempt to download a file, such as a PDF. The download is successful.

Sample log:

1: date=2023-08-18 time=17:15:29 eventtime=1692404129378193492 tz="-0700" logid="2500010001" type="utm" subtype="casb" eventtype="casb" level="information" vd="vdom1" msg="CASB access was allowed although it contained activity." policyid=9 sessionid=65452 srcip=10.1.100.195 dstip=162.125.1.15 srcport=62110 dstport=443 srcintf="port1" srcintfrole="undefined" dstintf="port3" dstintfrole="undefined" proto=6 action="bypass" profile="dropbox_test" saasapp="dropbox" useractivity="dropbox-download-file" activitycategory="activity-control"