Palo Alto vs. Fortinet

 We needed to configure the Internet-facing firewall for a customer to block encrypted files such as protected PDF, ZIP, or Microsoft Office documents. We tested it with two next-generation firewalls, namely Fortinet FortiGate and Palo Alto Networks. The experiences were quite different ...

Note that the Internet connection must be either unencrypted itself, ie, HTTP or FTP, or some TLS inspection / MITM techniques must be used to look into those encrypted streams such as HTTPS. Otherwise no firewall can ever recognize what kind of files are transferred over those connections. For our test purposes we used some test files at http://testfiles.webernetz.net/ . Since that webpage runs via HTTPS and plain HTTP we could run our tests without further security burdens. We tested a Palo Alto Networks PA-200 with PAN-OS 8.1.2 with threat version “8030-4788 (06/12/18)” and a Fortinet FortiGate FG-90D with firmware v5.6.4 .

For each firewall we did two runs, one with plain documents and another with encrypted documents. We downloaded four different document types in this order: docx, pdf, xlsx, zip . For every download we initiated a new HTTP session in order to have them distinguishable (different source ports). Before those tests we configured a “File Blocking” (Palo) and a “Data Leak Prevention” (Forti) profile in order to block encrypted file types:

Results Palo

The Palo Alto Networks firewall correctly identifies the four plain documents as seen in the "Data Filtering" log section. Depending on the file type a couple of different log entries are generated, though I downloaded only one document at a time. (I really do not know why the last run, source port 4025, in which I ONLY clicked the zip file also shows a download of the docx and pdf file. Maybe this is kind of a pre-download from the used Firefox 60.0 browser? )

Coming to the encrypted files, Palo Alto Networks does not recognize them correctly anymore . Bath. The two Microsoft Office files (docx, xlsx) are only detected as “Microsoft MSOFFICE” but not as “encrypted-docx” or “enrcypted-xlsx”. Note that I configured a “File Blocking” profile to block exactly those file types. Not working! At least the encrypted PDF and zip file is correctly identified:

We opened a ticket at the support portal from PAN. After some troubleshooting they admitted that it's not working. Hence, it is not a configuration error on our side, but a security malfunction. Bad design or whatever.

Results Forti

No problem with the plain documents as well. All four types are correctly identified by the FortiGate cyber security intern salary :

Conclusion

This one clearly goes to Fortinet. Palo Alto Networks fails at least for two out of our four test documents. To my mind it's not excusable for a firewall that has “encrypted-docx” or “encrypted-xlsx” file types is not able to detect them at all. What's up guys?

By the way: This was not the first time I struggled with the file blocking by PAN. Have a look at this blog post from 2013: Palo Alto File Blocking: Benefits and Limitations .