Application block page - not enabled by default

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L2 Linker

Application block page - not enabled by default

I've noticed in PAN OS 5.x that the application block page is not enabled by default. Obviously it can be manually enabled.. but was this done for a specific reason to address some common problems experienced by customers?

I could surmise that perhaps displaying the application block page might chew up limited sessions/resources on the PAN firewall as opposed to just issuing a RST by default? Perhaps compounded by the amount non-browser based applications which repeatedly try to connect out using http/https as their primary communication protocol..

Has anybody experienced specific problems when the application block page was enabled?

Tags (2)
Highlighted
L3 Networker

Well, its hard to say why this was disabled as a default setting for a specific reason.

But as far as the block page chewing up the sessions is concerned that definitely would not be an issue with the blocked applications, as the block page does not need additional sessions than the main browsing session, the block page is just pushed with a response page packet in the same session stream, so its highly unlikely that this would be an issue even with the non browser based apps.

HTH

Highlighted
L6 Presenter

If I recall it correctly this has been around for many years.

That is you must read the manual and manually configure stuff before response pages will show up.

I dunno of the reason for this (other than forcing customers to read the manual :smileysilly:), perhaps your SE could return to you with a better explanation and if you get such please update this thread aswell :smileyhappy:

Highlighted
L2 Linker

Are we able to enable the application-blockpage for internal zones only to avoid the block-page for incoming untrusted/internet-sessions?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!