File filter
A file filter can be configured to control the flow of different types of files passing through FortiGate. This is done by setting up rules that specify which file types are allowed or blocked. The file filter can be applied directly to firewall policies and supports various traffic protocols in proxy or flow mode. The feature set setting (proxy or flow) in the file filter profile must match the inspection mode setting (proxy or flow) in the associated firewall policy. For example, a flow-based file filter profile must be used with a flow-based firewall policy.
|
Protocol |
Proxy mode |
Flow mode |
|---|---|---|
|
CIFS |
Yes |
Yes |
|
FTP |
Yes |
Yes |
|
HTTP |
Yes |
Yes |
|
IMAP |
Yes |
Yes |
|
MAPI |
Yes |
No |
|
POP3 |
Yes |
Yes |
|
SMTP |
Yes |
Yes |
|
SSH |
Yes |
No |
|
WEBSOCKET |
Yes |
Yes |
File filtering is based only on the file type (file meta data) and not on file size or content. A DLP dictionary, sensor, and profile would need to be configured to block files based on size or content, such as SSN numbers, credit card numbers, or regular expressions (see Basic DLP settings for more information). See Supported file types for a list of the supported file types.
The following options can be configured in a file filter profile:
|
GUI option |
CLI option |
Description |
|---|---|---|
|
Basic profile settings |
||
|
Name |
name <string> |
Enter a unique name for the profile. |
|
Comments |
comment <var-string> |
Enter a comment (optional). |
|
Scan archive contents |
scan-archive-contents {enable | disable} |
Enable to scan archive contents. |
|
Feature set |
feature-set {flow | proxy} |
Select the feature set for the profile. The feature set mode must match the inspection mode used in the associated firewall policy.
If the Feature set option is not visible in the GUI, enter the following in the CLI: config system settings
set gui-proxy-inspection enable
end
|
|
n/a |
log {enable | disable} |
Enable to use file filter logging. This setting is enabled by default. |
|
n/a |
extended-log {enable | disable} |
Enable to use file filter extended logging. This setting is disabled by default. |
|
n/a |
replacemsg-group <string> |
Set a replacement message group. |
|
File filter rule settings |
||
|
Name |
name <string> |
Enter a unique name for the rule. |
|
Comments |
comment <var-string> |
Enter a comment (optional). |
|
Protocols |
protocol {option1}, {option2}, ... |
Set the protocols to apply to the rule. By default, all protocols are configured: CIFS, FTP, HTTP, IMAP, POP3, and SMTP in flow mode. Additionally, MAPI and SSH are configured by default in proxy mode. |
|
Traffic |
direction {incoming | outgoing | any} |
Set the traffic direction:
|
|
Password-protected only |
password-protected {yes | any} |
Enable ( |
|
File types |
file-type <name1>, <name2>, ... |
Select the file type. See Supported file types for the list of available options. |
|
Action |
action {log-only | block | warning} |
Set the action to take for a matched file:
|
See the following for file filter profile configuration examples: