topic FTD Malware File Policy in Endpoint Security

FTD Malware File Policy

iwearing — Sat, 09 Mar 2019 01:46:13 GMT

Hi,

I have created a malware file policy to block malware for PDF & Executables.

When I attach the malware file policy to my Access Control Policy acl I receive a warning " Configured Ports will prevent the file policy from being triggered"

The acl has a destination port of UDP-6064.

I have no issues when applying the malware policy to acls with destination TCP ports.

Any help would be appreciated.

thanks

Ian

Re: FTD Malware File Policy

David Janulik — Fri, 19 Jan 2018 10:47:43 GMT

Hello,

I am not sure, what do you mean with policy to block all PDF and executables.

If we get to the AMP console, you can blacklist a specific file SHA. You can block network connection e.g. specific ports, CIDR IP block or specifig IP address.

Did you try any of these?

Outbreak control > Custom detections
Outbreak control > Application blocking
Outbreak control > Network > IP blacklist

Regards

David

Re: FTD Malware File Policy

iwearing — Fri, 19 Jan 2018 12:36:43 GMT

Hello David,

Please see the attachment of an example Malware File Policy created on FMC. I should have referenced Executables and PDF as the file type category.

When I attach the Malware File Policy to the Access Control Policy I then receive warnings " configured ports will prevent the file policy from being triggered".

regards

Ian

Re: FTD Malware File Policy

jcorrea1 — Fri, 26 Oct 2018 22:36:55 GMT

Hi, I found this message is show when you use UDP and ICMP as destination ports. That's because this policy only applies in TCP ports.