block domain .zip and .mov

Here is my semi-official answer from Sophos.

The correct way to do this is with a URL Group, similar to what is posted by Wayne.

If you do this with a Category and use "domain" you cannot do a bare tld.  If you use "keyword" then it applies to anywhere in the url and has a lot of false positives.  You could theoretically use keyword with .zip/ and it would work with few false positives, the URL group is better - and more more CPU efficient.

Here is my semi-official answer from Sophos.

The correct way to do this is with a URL Group, similar to what is posted by Wayne.

If you do this with a Category and use "domain" you cannot do a bare tld.  If you use "keyword" then it applies to anywhere in the url and has a lot of false positives.  You could theoretically use keyword with .zip/ and it would work with few false positives, the URL group is better - and more more CPU efficient.

good news. next it would be cool to have a real block message appearing at the users browser, instead of

Firefox:

Edge is a bit better:

first load:

Edge after waiting some more seconds:

Chrome displays the correct error immediately:

I only know this messages from Intercept X. Our block messages from XG 230 look different:

That looks very similar to the messages I receive from my XG. I am not running interceptX on my devices.

Ian

I agree, usually the screenshots I posted above are from endpoint.

But when I remove the zip block from the URL group, I can access the page in browser. here firefox

Interesting, for me this works fine. And it´s showing the firewall message I posted above. What´s the result when testing the URL on the firewall?