Anti-virus Block Option Not Available

[cpatte7372]

Hello Community,

I would like to set an Antivirus action to 'Block', but for some reason that option isn't available, see image. However, it has been available on my other PA-VM. Can someone explain why I can't see that option here?

[SamKear · Accepted solution]

These are the only available actions for antivirus profiles.  Drop along with reset-both are the same as "block".  Drop will silently drop the traffic.  Reset-both will send TCP resets to both the client and server (or drops the traffic if its UDP).

I have my profiles configured to reset-both.  In the case of a incoming virus over SMTP, reset-both will send a 541 response to the mail server preventing it from attempting to resend the blocked message again.

You can find more information about this in the administrator's guide.

[LCMember1959]

Has this been changed in recent versions? We are running 6.1.10 and have the block option in our antivirus profile.

[kiwi]

Hi,

This is mentioned in the 7.0 release notes.

It's one of the changes to default behavior in PAN-OS 7.0 :

---Release Notes---

The default actions for handling threats now are alert or reset-both (sides of the connection). In releases prior to PAN-OS 7.0.0, the defaults were alert or block. On upgrade, the block action will be converted to reset-both; and the drop-packets option is now renamed as drop. On downgrade, all actions configured as drop or reset, will be converted to block.

---Release Notes---

regards,

-Kim.

[Raido_Rattameister]

Block in older version is reset-both in newer version. Plus there are now options to drop silently or reset only one side.