Troubleshooting Internet Access Blocking During Multiple Attachment Uploads in Microsoft Outlook on Sangfor NGFW 1200F

A connectivity issue was observed when users uploaded multiple attachments through Microsoft Outlook while the Content Security (AI-based Engine Zero File Verification) feature was enabled in the Internet Access Security Policy. When the action was configured as Deny, user Internet access was temporarily blocked during the attachment upload process.

Disabling the protection feature by selecting Allow resolved the issue but weakened the organization's security posture. After further investigation, the root cause was found within the Content Security template configuration.

Symptoms

• Users experience temporary Internet access interruption when uploading multiple attachments in Microsoft Outlook.
• The issue occurs when Content Security (AI-based Engine Zero File Verification) is enabled with the Deny action.
• Outlook attachment uploads may fail or cause network sessions to be blocked.
  
  

Initial Configuration

Navigate to: Network Security → Policies → Internet Access Scenario

Content Security (AI-based Engine Zero File Verification) Action: Deny

This configuration may cause Outlook attachment uploads to be blocked when document files are submitted for Engine Zero verification.

Solution

Step 1: Open the Content Security Template

Navigate to: Objects → Security Policy Template → Content Security

Select the template used by the Internet Access Scenario, for example: Default Template_Internet Access Scenario

Open the template configuration.

Step 2: Access Advanced Settings

Within the Content Security template:

Locate the Protection section. Click Advanced.

This menu contains detailed file verification and email protection settings.

Step 3: Modify Engine Zero File Verification

Under the File Protection section:

Locate Verify Files with Engine Zero. Click File Types.

By default, the file type category Documents is included in the verification scope. This causes document attachments such as:

DOCX XLSX PPTX PDF

to be inspected by Engine Zero during upload.

Step 4: Exclude Document Files

In the Select File Type window:

Find the Documents category. Uncheck Documents. Click Save.Apply the configuration changes.

After excluding document file types from Engine Zero verification, Outlook can upload multiple document attachments without triggering temporary Internet access blocking.

Root Cause

The issue occurred because Engine Zero File Verification was configured to inspect document file types during upload activities. When multiple attachments were uploaded simultaneously through Microsoft Outlook, the verification process could trigger security enforcement, resulting in temporary network access blocking for the user's session

Result

After removing the Documents file category from Verify Files with Engine Zero:

Microsoft Outlook successfully uploads multiple attachments. User Internet connectivity remains stable. Security protection remains active for other high-risk file categories, such as executable files and compressed archives. Network security is maintained while minimizing false-positive blocking.

Recommendation

Rather than completely disabling Content Security or changing the action from Deny to Allow, it is recommended to fine-tune the Engine Zero File Verification policy by excluding specific document file types that generate false positives. This approach helps maintain an optimal balance between usability and security within the Sangfor NGFW 1200F environment.

Thanks for sharing!

Thanks for sharing!

Excellent RCA Sameer, thanks for detailed steps with screenshots.

This Engine Zero + Outlook bulk attachment issue is common on NGAF 8.0.47+ . When 4-5 docs upload together, Engine Zero triggers file verification flood and Session hits threat threshold, so NGAF blocks that user IP temporarily thinking it's malicious burst.

Your solution is best practice - exclude Documents category from Engine Zero instead of Allow All Content Security. We keep Executable, Script, Archive checked - that's where real zero-day risk is.

One more check for others facing same: Check Log > Security Logs > Content Security to see the block reason before tuning. Helps confirm it's Engine Zero and not File Filter.

Thanks for sharing!

Thanks for sharing detailed solution Sameer - very useful!

We also faced same issue on NGAF 1200F - user reported internet disconnect when sending 3-4 docs via Outlook. We initially thought it was session limit but actually it was Engine Zero blocking.

Your fix is correct. Best practice we now follow: Keep Engine Zero ON but exclude Documents category as you did. Keep Executable + Compressed + Scripts enabled for security, documents have very high false positive during bulk upload.

Also one tip - if customer still wants document scanning, change Action from Deny to Alert first to monitor, instead of direct Deny.

Great troubleshooting and screenshots, thanks!

Good information.

Thanks to share!