Max file size limit was exceeded

Products

• SG-S500
• SG-S400
• Secure Web Gateway Virtual Appliance
• SG-S200
• ProxySG Software - SGOS
• SWG VA-100
• ISG Proxy
• ISG Content Analysis
• Content Analysis Software

Issue/Introduction

Content Analysis reports alerts with "Maximum file size exceeded" and "File has been dropped" messages, but the edge SWG (ProxySG) continues to serve the files. 

Why does the edge SWG (ProxySG) serve an object even though the Content Analysis reports that it drops the object because the Max file size limit is exceeded?

Resolution

Suppose the "Error handling" setting on the ICAP response service object is set to "Continue without further ICAP response processing". In that case, even though the Content Analysis reports the Alert with "Maximum file size exceeded" and "File has been dropped" messages, the edge SWG (ProxySG) will continue to serve the file. 

This is an expected behavior as the edge SWG (ProxySG) does as it is configured.

 

To prevent this from happening, set the ICAP response modification rule to deny the client request under the Visual Policy Manager (VPM) > Web Content Layer > Action column for the Perform Response Analysis as shown below.