Contentfilter blocks attachment even if it's on whitelist

[hu]

hi there,

i've configured a contentfilter-rule to allow only certain attachments. e.g. there are 2 PDF-rules that say:

(Mail Policies > Email Security Manager > Incoming Content Filters)

attachment-filetype != "pdf"

attachment-filename != ".PDF$"

so if filetype isn't pdf OR filname does not end with ".PDF" move the mail to the quarantine.

this rule works approx 98 % of the time. sometimes there are pdf files which the filterrule moves to the quarantine even if it's a perfect pdf. 

the question is....why? is there a way to find out, what the problem was? e.g. the last attachment were this occured had the filename 

AVL Liefererinnerung für Lieferant 94.pdf

could the filename be the reason for this behaviour?

any tipp would be appreciated,

cheers from austria

hans

[Collin Clark]

I think the regex is partially wrong. You could write both of your filter statements in one and cover both.

attachment-filetype != \.pdf$

[hu]

hi collin,

thx for your answer. I created the rule in the WebGUI of the Mail-Sec-Appliance so the regex should be ok. At least I hope so :-)

As mentioned the rule works most of the time. But in some cases files get filtered even if the rule does not apply.

[Libin Varghese]

Hi,

Just to confirm, do you have the filter condition set to OR/AND.

If you are looking to take action for all attachments that are not pdf then the condition should be AND.

You could also try including (?i) to make the condition case insensitive.

Thank You!

Libin Varghese

[hu]

hi there again,

it seems, that the problem is/was that the pdf-File was encapsulated within an outlook container (Contentype „CDFV2 Microsoft Outlook Message“). this contenttype was not on the whitelist and this might be the reason why the pdf was blocked.

i added a contentfilter-rule to address this "new" contenttype an now I'll wait and see :-)

thx so far for your answers.

cheers

hans

[Libin Varghese]

Hans,

Thank you for the update.

Glad it worked out.

- Libin V