topic Re: Anti-virus Block Option Not Available in General Topics

Anti-virus Block Option Not Available

cpatte7372 — Wed, 08 Jun 2016 17:59:52 GMT

Hello Community,

I would like to set an Antivirus action to 'Block', but for some reason that option isn't available, see image. However, it has been available on my other PA-VM. Can someone explain why I can't see that option here?

Re: Anti-virus Block Option Not Available

Retired Member — Wed, 08 Jun 2016 18:39:33 GMT

These are the only available actions for antivirus profiles. Drop along with reset-both are the same as "block". Drop will silently drop the traffic. Reset-both will send TCP resets to both the client and server (or drops the traffic if its UDP).

I have my profiles configured to reset-both. In the case of a incoming virus over SMTP, reset-both will send a 541 response to the mail server preventing it from attempting to resend the blocked message again.

You can find more information about this in the administrator's guide.

Re: Anti-virus Block Option Not Available

LCMember1959 — Thu, 09 Jun 2016 10:05:25 GMT

Has this been changed in recent versions? We are running 6.1.10 and have the block option in our antivirus profile.

Re: Anti-virus Block Option Not Available

kiwi — Thu, 09 Jun 2016 10:24:12 GMT

Hi,

This is mentioned in the 7.0 release notes.

It's one of the changes to default behavior in PAN-OS 7.0 :

---Release Notes---

The default actions for handling threats now are alert or reset-both (sides of the connection). In releases prior to PAN-OS 7.0.0, the defaults were alert or block. On upgrade, the block action will be converted to reset-both; and the drop-packets option is now renamed as drop. On downgrade, all actions configured as drop or reset, will be converted to block.

---Release Notes---

regards,

-Kim.

Re: Anti-virus Block Option Not Available

Raido_Rattameister — Thu, 09 Jun 2016 10:24:54 GMT

Block in older version is reset-both in newer version. Plus there are now options to drop silently or reset only one side.