topic Re: Block page for vulnerability protection in General Topics

Block page for vulnerability protection

oshcomp — Tue, 27 Mar 2012 21:09:58 GMT

I have been testing the security profile for vulnerability protection. I set the action for all critical threats to block. What should I expect to see on the user computer screen if a site does contain a critical threat recognized by Palo Alto? Should the user see a block page?

Re: Block page for vulnerability protection

mikand — Tue, 27 Mar 2012 22:06:54 GMT

If the client is using a browser it should see the block page which informs the client of why access have been blocked.

Dont forget to enable ssl-termination in order to inspect (and block) bad stuff using https.

You can also make custom block pages if you wish (for example if you wish to use a different design/layout or for that matter use a local language).

Check the PA-4.1_Administrators_Guide.pdf for more info (search for "block page").

Re: Block page for vulnerability protection

fredallee — Wed, 28 Mar 2012 23:49:59 GMT

No, the user would not see a block page for a vulnerability exploit that was detected. If a specially crafted web page contained an exploit, we would take the action associated with that signature on the profile, i.e. drop all packets and send a tcp reset to the client, server, or both, alert, etc. We don't have a block page for vulnerability protection.

Re: Block page for vulnerability protection

mikand — Thu, 29 Mar 2012 06:13:20 GMT

Ahh yes sorry, was thinking of something else.

"Vuln protection" in PAN is the IDP engine which acts at session-control level (just dropping the packets or sending tcp-rst's to make server and/or client to drop the connection).

Current possible response pages seems to be (which you also can make your own versions of):

- Default Antivirus Response Page

- Default Application Block Page

- Default File Blocking Block Page

- Default URL Filtering Response Page

- Default Anti-Spyware Download Response Page

- Default Decryption Opt-out Response Page

- Captive Portal Comfort Page

- URL Filtering Continue and Override Page

- SSL VPN Login Page

- SSL Certificate Revoked Notify Page