How can I block FTP / HTTP file downloads and upload using Application Control Advanced?

12/20/2019 55 21342

DESCRIPTION:

The application signature databases that were previously included with SonicWall Intrusion Prevention Service (IPS) are now part of the Application Control feature. These signature databases are used to protect users from application vulnerabilities as well as worms, Trojans, peer-to-peer transfers, spyware and backdoor exploits. The extensible signature language used in SonicWall’s deep packet inspection engine also provides proactive defense against newly discovered application and protocol vulnerabilities.

The configuration method on the Firewall | App Control Advanced page (In Gen5 TZ Series it's on the Security Services | App Control Advanced page) allows granular control of specific categories, applications, or signatures. This includes granular logging control, granular inclusion and exclusion of users, groups, or IP address ranges, and schedule configuration. The settings here are global policies and independent from any custom App Rules policy.

This article describes the method to block downloads of file-types like Executables, Archives, Documents, Database files, Images, Stream using HTTP or FTP. The file-type signatures are grouped under the categories FILE-TYPES-HTTP (Category ID 72) and FILE-TYPES-FTP (Category ID 73). The primary purpose of these signatures is to provide True-File Type detection based on a file's contents rather than relying on the provided file extension or MIME type.This solution would be applicable to webmail downloads if using FILE-TYPES-HTTP.

RESOLUTION:

• Login to the SonicWall management GUI.
• Navigate to the Firewall | App Control Advanced page.
• Check the box under Enable App Control and click Accept at the top of the page.
• Under View Style: Category, select FILE-TYPES-HTTP or select FILE-TYPES-FTP.
• Under Application, select the file-type that you want to block. The following file-types are available.

• ArchiveDatabase File
• Document
• Executable
• Image
• Stream

You can block using the following methods:

• Block the application category FILE-TYPES-HTTP or FILE-TYPES-FTP.
• Block individual file-types (eg. executables, archives, documents etc).
• Block individual signatures (eg. exe, pdf etc).

The ensuing sections illustrate each of the above methods.

Block the application category FILE-TYPES-HTTP or FILE-TYPES-FTP

• Under View Style: Category, select FILE-TYPES-HTTP or select FILE-TYPES-FTP.
• Click  Configure button to bring up the Edit App Control Category window.
• Select Enable under Block.
• Select Enable under Log.
• Click OK .
  

Block individual file-types (eg. executables, archives, documents etc)

• Under View Style: Category, select FILE-TYPES-HTTP or select FILE-TYPES-FTP.
• Under Application select the file-type you wish to block (Executable in this example) .
• Click  Configure button to bring up the Edit App Control App window.
• Select Enable under Block.
• Select Enable under Log.
• Click OK .

Select other file-types to block multiple file-types.

Block individual signatures (eg. exe, pdf etc)

• Under View Style: Category, select FILE-TYPES-HTTP or select FILE-TYPES-FTP.
• Under Application select the file-type you wish to block (Executable in this example) .
• Under Viewed By, select Signature to list all the signatures under the file-type selected.
• Click Configure button on any of the signatures listed to bring up the Edit App Control Signature window (  PE/COFF 4 (HTTP Download) in this Example).
• Select Enable under Block.
• Select Enable under Log.
• Click OK.

Select other signatures to block multiple signatures.

Log Messages

When hosts behind the SonicWall try to download a file marked for blocking, they will get blocked and the following messages will be logged:

NOTE:  This knowledge base article is applicable for HTTP/FTP file uploads as well.