topic Re: Application block page - not enabled by default in General Topics

Application block page - not enabled by default

CMG — Sat, 10 Aug 2013 14:38:30 GMT

I've noticed in PAN OS 5.x that the application block page is not enabled by default. Obviously it can be manually enabled.. but was this done for a specific reason to address some common problems experienced by customers?

I could surmise that perhaps displaying the application block page might chew up limited sessions/resources on the PAN firewall as opposed to just issuing a RST by default? Perhaps compounded by the amount non-browser based applications which repeatedly try to connect out using http/https as their primary communication protocol..

Has anybody experienced specific problems when the application block page was enabled?

Re: Application block page - not enabled by default

Chatri — Sun, 11 Aug 2013 06:01:14 GMT

Well, its hard to say why this was disabled as a default setting for a specific reason.

But as far as the block page chewing up the sessions is concerned that definitely would not be an issue with the blocked applications, as the block page does not need additional sessions than the main browsing session, the block page is just pushed with a response page packet in the same session stream, so its highly unlikely that this would be an issue even with the non browser based apps.

HTH

Re: Application block page - not enabled by default

mikand — Sun, 11 Aug 2013 18:50:04 GMT

If I recall it correctly this has been around for many years.

That is you must read the manual and manually configure stuff before response pages will show up.

I dunno of the reason for this (other than forcing customers to read the manual :smileysilly:), perhaps your SE could return to you with a better explanation and if you get such please update this thread aswell

Re: Application block page - not enabled by default

indup089 — Tue, 11 Feb 2014 11:12:49 GMT

Are we able to enable the application-blockpage for internal zones only to avoid the block-page for incoming untrusted/internet-sessions?