topic Re: Response Page not displayed when using security policy to deny URL category in General Topics

Response Page not displayed when using security policy to deny URL category

PerreauLuc — Tue, 19 Jan 2021 08:00:25 GMT

Hi There,

I have configured a security policy to block a URL category using the Service/URL Category method and my action is deny.

This works and the category is denied, however the block response page is not displayed. Instead i get "This site can’t be reached" and "ERR_CONNECTION_RESET".

When i block the same category using the URL Filtering Security Profile, the block response page is displayed.

This behavior is the same for both encrypted and unencryted pages and also on PAN OS 9.1.7 as well as on 10.0.2.

Any idea if this is normal behavior or if this is something that i can fix?

Thanks in advance 🙂

Response Page not displayed when using security policy to deny URL category

Re: Response Page not displayed when using security policy to deny URL category

nikoolayy1 — Mon, 29 Mar 2021 06:31:52 GMT

Can you confirm that you are matching the correct policy that just blocks with the the category, also I think before this rule there should be rules that identify the the app id as web-blowsing or ssl, so check the traffic that the app-id is identified correctly.

Please see:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/test-policy-rule-traffic-matches.html

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC

Can you provide a screenshot of the rule as maybe it also has App ID in the rule and maybe you need "Application Block Page" as this triggered first etc.?

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/device/device-response-pages.html

Re: Response Page not displayed when using security policy to deny URL category

BPry — Mon, 29 Mar 2021 23:39:18 GMT

@PerreauLuc,

Assuming that you are attempting to block an HTTPS site, and that you aren't decrypting said traffic which would cause the issue you are describing, this behavior is expected. You would need to following https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFKCA0 to get this functioning. By default, the firewall won't attempt to serve a response page if you aren't decrypting the traffic because it would just lead to a certificate warning.

Re: Response Page not displayed when using security policy to deny URL category

MKoehler — Tue, 25 Oct 2022 09:29:52 GMT

Hi all

I face the exact same Issue.

I have enabled response pages and tried it with an url category profile using: http://urlfiltering.paloaltonetworks.com/test-malware.

This worked perfectly fine.

However: I went on, removed the url profile and added the Service/URL Category "malware", set the rule to deny and I'm presented with a browser message telling me the network connection was interrupted. (no response page)
So either this is by design / technical limitation or it's a bug.

PA-220, 10.2.2

find my rule below

Re: Response Page not displayed when using security policy to deny URL category

Jake_Aguinaga — Thu, 03 Nov 2022 19:51:48 GMT

I am seeing the same behavior. PA-3250 10.2.3

Re: Response Page not displayed when using security policy to deny URL category

Adrian_Jensen — Thu, 03 Nov 2022 20:56:25 GMT

To me it would seem to be operating as designed and expected behavior.

With a Security Policy you select targets by some combination of IP, zone, user, service, and/or URL(SNI); and running a deny action you are sending a TCP or UDP reset to the endpoint. It doesn't matter or necessarily operate on HTTP/HTTPS. Therefore the browser just gets a connection closed message, no actual content response.

With URL Filtering you are filtering content inside the HTTP/HTTPS connection. So when a block happens you are interrupting the content stream and can return a different content page, vs. just terminating the network connection.

Re: Response Page not displayed when using security policy to deny URL category

KhaleelE — Tue, 11 Jul 2023 13:22:40 GMT

I also have same issue. For https website Iam not getting the response page. Any solution?