> Source: [sk106421](https://support.checkpoint.com/results/sk/sk106421)

# sk106421 - Downloaded file might be bypassed instead of being blocked by DLP

| Property | Value |
|----------|-------|
| Solution ID | sk106421 |
| Date Created | 2015-06-10 |
| Last Modified | 2017-05-27 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- Downloaded file might be bypassed instead of being blocked by DLP in the following scenario:

* DLP blade is enabled.
* Threat Emulation blade is enabled.
* Threat Emulation Connection Handling Mode is set to "*Background* " (*Threat Prevention* tab - open *Profiles* - select the relevant profile - click on *Edit...* button - go to *Threat Emulation Settings* - go to *Advanced* )  
  [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106421/TE_Background.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106421/TE_Background.png "Click the image to see it in full size in a new tab/window")
* Threat Prevention Engine Fail Mode is set to "*Allow all connections (Fail-open)* " (*Threat Prevention* tab - open *Advanced* - go to *Engine Settings* )  
  [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106421/Engine_Settings.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk106421/Engine_Settings.png "Click the image to see it in full size in a new tab/window")

## Cause

Both DLP blade and Threat Emulation blade are inspecting the downloaded file. Threat Emulation might fail to process the file (e.g., no entitlement or internal error), and goes into Fail-open mode.

Although the logged action of DLP blade would be "Prevent", the actual action would be "Detect". As a result, the file would be bypassed.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content