topic Re: Blocking page for https traffic in General Topics

Blocking page for https traffic

VinceM — Mon, 02 Jun 2014 15:03:41 GMT

Hi all,

We are currently on PA-2050 in version 5.0.9.

Creating Web secur profile for test categorie (with PAn-DB).

If trying to access blocked page in http => block page (NICE !!)

If trying to access blocked page in https => Page "session has been reste" - default browser block page.

Would like to have the palo block page everytime.

Can you help me to configure that ?

Thx in advance.

Re: Blocking page for https traffic

HULK — Mon, 02 Jun 2014 16:36:55 GMT

Could you please confirm that Decryption policy is configured on the PAN FW or not, if not, then you have to configure:

A certificate on the PAN Device. One of the following:
- A self-signed/self-generated certificate which is a CA certificate configured for Forward Trust / Forward Untrust use (as relevant to deployment requirements)
  Note: if using a self-signed/sef-generated certificate it will be necessary to import this certificate into the client machine's certificate store to avoid unwanted browser certificate errors
- An intermediate CA certificate installed on the PAN Device which was generated by an organization's internal CA also configured for Forward Trust / Forward Untrust use

Even though you haven't configured a decryption policy, The PAN firewall will internally decrypt the packet to push the BLOCK page notification in front of the end user, during handshake.

How to Configure the Palo Alto Networks Device to Serve a URL Response page Over an HTTPS Session without SSL Decryption

But, as per my experience, you will get the best result with a decryption policy.

Thanks

Re: Blocking page for https traffic

VinceM — Tue, 03 Jun 2014 07:42:20 GMT

Hi Hulk,

thx for your answer. Will test that as faster as possible 🙂

cheers.