topic Is there a way to disable response page for interface? in General Topics

Is there a way to disable response page for interface?

junior_r — Sat, 09 Nov 2019 14:54:13 GMT

I am blocking some applications coming inbound from the internet to a certain IP. This creates a response page when I have application block response page on. How can I stop response page from being server to outside zone?

Re: Is there a way to disable response page for interface?

Brandon_Wertz — Mon, 11 Nov 2019 15:25:45 GMT

Management profiles create the way you can disable response pages. Create a new management profile with "response pages" unchecked.

Re: Is there a way to disable response page for interface?

cradle — Sat, 20 Jun 2020 06:12:02 GMT

Excuse me.If use Virtual Wire interface Type.

How can disable the response page form internet?

Re: Is there a way to disable response page for interface?

MP18 — Sat, 20 Jun 2020 16:42:52 GMT

Hi,

do you have cureently response page configured on vwire mode from Internet?

Below is the link i found to enable the response page on the vwire mode

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJcCAK

If you have used above link to enable the response page then under response page change the action to disable

Re: Is there a way to disable response page for interface?

cradle — Mon, 22 Jun 2020 10:00:31 GMT

Thanks for your help.I have read this article.

Take URL Filtering as an example. Generally speaking, the settings are from inside to outside. If outside to inside, the server of the customized external service is deliberately turned into a blocked list. Will Internet users have Response Pages?
After testing, Internet users will not have Response Pages. Of course, this is the result I want, just want to understand the working principle of Response Pages.

Re: Is there a way to disable response page for interface?

MP18 — Tue, 23 Jun 2020 04:27:10 GMT

So far I never heard about Response Pages for Internet users.

But as per config option it can be done if you have user id info on the outside interface

Re: Is there a way to disable response page for interface?

cradle — Tue, 23 Jun 2020 08:26:32 GMT

Hi MP18:

you're right. I have never heard of a response page for Internet users.

I never thought about this kind of problem.

It’s just that the customer asks.

If I can understand how the response page works, I can correctly answer customer questions.

So far, I know about the direction of this problem. Thank you for your help.

Re: Is there a way to disable response page for interface?

igorbot — Tue, 06 Apr 2021 19:34:06 GMT

We were testing a new web site from the outside and were surprised to see a response page going out.. I understand why the page was blocked being new and still 'unknown' so 'high-risk' but the response page going out to the wild seems like a bit much info. The external 'untrust' interface has a Interface Mgmt profile on it with only the ping box checked.

Re: Is there a way to disable response page for interface?

Prejean587 — Wed, 07 Apr 2021 09:11:46 GMT

@junior_r wrote:
I am blocking some applications coming inbound from the internet to a certain IP. This creates a response page when I have application block response page on. How can I stop response page from being server to outside zone?

Turn off Response Pages in your management profile assigned to the interface.

Re: Is there a way to disable response page for interface?

Sec101 — Thu, 13 Oct 2022 14:25:34 GMT

appears this may no longer work on 10.1--- we are still getting response pages even though my interface mgmt profile is off.

Re: Is there a way to disable response page for interface?

FabioHufschmid — Tue, 18 Jun 2024 08:13:56 GMT

We also have this problem. How can i disable on PANOS 10.2.x? If inbound traffic, a.e to a reverse proxy is decrytped and certain urls allowed for a handfull src ips but for all other not, the firewall display a application block page. For internal to internet this is ok, but not for the other way. Also chancing the policy action to drop or reset client does not work. We also have the interface mngt profile on the internet interface, without response pages, but they are displayed. Seams to be a bug.

Re: Is there a way to disable response page for interface?

Brandon_Wertz — Tue, 18 Jun 2024 17:19:01 GMT

@FabioHufschmid wrote:

We also have this problem. How can i disable on PANOS 10.2.x? If inbound traffic, a.e to a reverse proxy is decrytped and certain urls allowed for a handfull src ips but for all other not, the firewall display a application block page. For internal to internet this is ok, but not for the other way. Also chancing the policy action to drop or reset client does not work. We also have the interface mngt profile on the internet interface, without response pages, but they are displayed. Seams to be a bug.

Unfortunately it isn't a bug, and counter to my understanding and belief years ago (in 2019) in my post this isn't something that can be turned off.

Using application level blocking (APP-ID) is a global thing and actually has ZERO to do with a management profile and enabling response pages. If enabling response pages on APP-ID there is no way to not present a response page to an untrusted zone.

The interface management profiles, enabling or disabling response pages there is a HTML level thing and isn't associated with the APP-ID response page function.

This is what I was told from my Focus Services account team and DE.

So in short it's either on or off globally as far as APP-ID response pages are concerned. Anything else is a Feature Request / enhancement to the product.