Secure Access Password-Protected ZIP File Download Configuration

Available Languages

Download Options

PDF (7.1 KB)
View with Adobe Reader on a variety of devices
ePub (83.2 KB)
View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle) (68.3 KB)
View on Kindle device or Kindle app on multiple devices

Updated:August 11, 2026

Document ID:226249

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Issue

After migrating to Cisco Secure Access, users are unable to download password-protected (encrypted) ZIP files. The downloads fail consistently when attempting to access encrypted file content through the Secure Access service. This issue occurs despite having configured internet-bound traffic policies on a C8200 device with multiple security rules including category-based blocking, SSL inspection controls, and sandbox functionality.

Users experience complete download failures when attempting to access password-protected ZIP files that were previously accessible before the Secure Access migration. The issue persists across multiple tunnel groups and affects all 15 configured locations.

Environment

Cisco Secure Access (Secure Access OrgID: 8320925)
C8200 device managing internet-bound traffic policies
Multiple tunnel groups across 15 locations (TK-TG and others)
SSL inspection policies with both enabled and disabled configurations
Sandbox security profiles enabled on certain policies
IPS profiles configured on specific access rules

Resolution

The resolution for allowing password-protected ZIP file downloads in Cisco Secure Access involves configuring the Allow access to encrypted files setting and implementing appropriate workarounds when necessary.

Primary Configuration Method

Step 1: Access the Cisco Secure Access Policy Configuration

Navigate to the specific access policy that handles the affected traffic in your Cisco Secure Access dashboard.

Step 2: Enable Encrypted File Access

In the policy Advanced Settings, locate and enable the Allow access to encrypted files option. This setting is configured on a per-rule basis and controls whether encrypted content can be accessed through that specific policy.

Step 3: Apply the Configuration

Save and apply the policy changes to make them active for user traffic.

Alternative Workaround Method

If the primary method does not resolve the issue, implement the workaround described in the next sections.

Step 1: Identify Affected URLs

Determine the specific URLs or domains where password-protected ZIP files are hosted and causing download failures.

Step 2: Configure Do Not Decrypt List

Add the identified URLs to the Do Not Decrypt list in your Cisco Secure Access configuration. This prevents SSL inspection on these specific URLs.

Step 3: Create SSL Inspection Bypass Policy

Ensure that an access policy with SSL inspection disabled is configured to handle traffic to these URLs.

This policy must have:

SSL inspection disabled
All security profiles disabled
Higher priority than SSL inspection enabled policies

Policy Configuration Reference

The policy order outlined in the next subsections and their respective configurations can be used as a reference for proper traffic handling.

Policy 1: Category-based Blocking Rule

Policy Name: IA-To-InternetContentBlock
IPS Profile: None
Purpose: Block specific content categories
Target: All tunnel groups

Policy 2: SSL Inspection Disabled Rule

Policy Name: IA-SSL-Inspection-MUKOU
IPS Profile: Disabled
Security Profiles: All disabled
Target: All tunnel groups

Policy 3: SSL Inspection-enabled Rule

Policy Name: IA-SSL-Inspection
IPS Profile: Enabled
Security Profiles: Sandbox functionality enabled
Target: All tunnel groups

Important Configuration Notes

No Global Settings equivalent exists for the Allow access to encrypted files functionality. This setting must be configured on individual access policies as needed. Each policy that requires encrypted file access must have this setting explicitly enabled in its Advanced Settings configuration.

When testing configuration changes, allow sufficient time for policy propagation across the Cisco Secure Access infrastructure before validating functionality. Service incidents or maintenance windows can affect testing results and must be considered when troubleshooting.

Cause

The issue occurs because Cisco Secure Access, by default, blocks access to encrypted files as a security measure. When SSL inspection is enabled and encounters password-protected or encrypted content, the service prevents download unless explicitly configured to allow such access. The Allow access to encrypted files setting in the Advanced Settings of access policies controls this behavior, and without this setting enabled, encrypted ZIP files and similar content is blocked during the download process.

Additionally, SSL inspection policies can interfere with encrypted file downloads when the inspection process cannot properly handle the encrypted content, requiring either the encrypted file access setting or SSL inspection bypass for affected URLs.