File policy best practices

Follow these best practices for file policy configuration to ensure proper functionality and optimal performance.

Prerequisites

  • For file blocking to work, the NAP policy you apply to the access control policy must be operating in Protection mode, also known as Inline mode.

  • You can associate a single file policy with an access control rule whose action is Allow, Interactive Block, or Interactive Block with reset.

  • You cannot use a file policy to inspect traffic handled by the access control default action.

Encrypted traffic

By default, file inspection of encrypted payloads is disabled. This helps reduce false positives and improve performance when an encrypted connection matches an access control rule that has file inspection configured.

Attention

The File Inpsect preprocessor with the following generator IDs (GIDs) are enabled by default for file/malware policy: GID: 146 and GID: 147.

General file policy best practices

  • For a new policy, the web interface indicates that the policy is not in use. If you are editing an in-use file policy, the web interface tells you how many access control policies use the file policy. In either case, you can click the text to jump to the Access Control Policies page.

  • Based on your configuration, you can either inspect a file the first time the system detects it, and wait for a cloud lookup result, or pass the file on this first detection without waiting for the cloud lookup result.

  • If you enable an access control policy with a file policy that uses either a Malware action or a Store Files option, the computing power and system performance of the device is reduced.

  • NEW_OFFICE file type in file policy configuration identifies Microsoft files: DOCX, XLSX, and PPTX. When you apply a policy action to NEW_OFFICE, the action applies uniformly to all three file types—DOCX, XLSX, and PPTX.

    If your security requirements need differentiated handling of Office file formats, such as blocking DOCX documents while permitting XLSX spreadsheets, do not use the NEW_OFFICE aggregate file type. Instead, perform these steps:

    1. Select individual file types (DOCX, XLSX, PPTX) separately in your file policy rule.

    2. Create separate rules with distinct actions for each format you need to control granularly.

    3. Test your policy to ensure each Office format is handled according to your security intent.

    This approach ensures that your file policy aligns with your organization's security posture and prevents unintended blocking of legitimate business traffic.