Max file size limit was exceeded

book

Article ID: 167551

calendar_today

Updated On:

Products

SG-300 Symantec WebFilter (formerly Blue Coat WebFilter - BCWF) SG-600 Intelligence Services SG-510 SG-810 SG-9000 SG-900 SG-S500 SG-S400 Secure Web Gateway Virtual Appliance SG-S200 ProxySG Software - SGOS SWG VA-100

Issue/Introduction

 ProxyAV reports Alerts with "Maximum file size exceeded" and "File has been dropped" messages, but ProxySG continues to serve the files. 

Why does the ProxySG serve an object even though the ProxyAV reports that it dropped the object because Max file size limit was exceeded?

Resolution

If the "Error handling" setting on your ICAP response service object is set to "Continue without further ICAP response processing", even though the AV reports the Alert with "Maximum file size exceeded" and "File has been dropped" messages, the ProxySG will continue to serve the file. 

 
This is an expected behavior as the ProxySG does as it configured. To prevent this from happening, set your ICAP response modification rule to fail closed as show below. 
 
 
 

 

Attachments