Cisco Firepower filepolicy

[ccna_security]

Hello. Could anyone please tell me why encrypted zip file seen on log as ZIP ENC but encrypted rar file  only RAR. I send from one network to different network in order test file policy. When i send encrypted zip file it is written ZIP ENC on logs. But rar file wont qive us same result. IT just show as is it is simple (unencrypted RAR file). Please see attachment

[Sheraz.Salim]

just be aware you can only do a file inspection with these protocols

The system can detect and inspect files transmitted via FTP, HTTP, SMTP, IMAP, POP3, and NetBIOS-ssn (SMB). the default, detects files in HTTP, SMTP, IMAP, POP3, FTP, and NetBIOS-ssn (SMB) traffic. To improve performance, you can restrict file detection to only one of those application protocols on a per-file rule basis.

[ccna_security]

Hi. I have already configured file policy application as any any. My question is that why encrypted zip file seen as ZIP ENC on log when it is sent over SMb but encrytped rar not seen as RAR ENC.

[Sheraz.Salim]

I did google and read some cisco documentation but could not came across the answer of your question. might TAC engineer can put some light on this.

having said that, i find a one doc which could be useful for you but it does not answer your question. and if any chance you find the answer than do share with us too.

https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Reference_a_wrapper_Chapter_topic_here.pdf