Block page for vulnerability protection

[oshcomp]

I have been testing the security profile for vulnerability protection.  I set the action for all critical threats to block. What should I expect to see on the user computer screen if a site does contain a critical threat recognized by Palo Alto?  Should the user see a block page?

[mikand]

If the client is using a browser it should see the block page which informs the client of why access have been blocked.

Dont forget to enable ssl-termination in order to inspect (and block) bad stuff using https.

You can also make custom block pages if you wish (for example if you wish to use a different design/layout or for that matter use a local language).

Check the PA-4.1_Administrators_Guide.pdf for more info (search for "block page").

[fredallee · Accepted solution]

No, the user would not see a block page for a vulnerability exploit that was detected. If a specially crafted web page contained an exploit, we would take the action associated with that signature on the profile, i.e. drop all packets and send a tcp reset to the client, server, or both, alert, etc. We don't have a block page for vulnerability protection.

[mikand]

Ahh yes sorry, was thinking of something else.

"Vuln protection" in PAN is the IDP engine which acts at session-control level (just dropping the packets or sending tcp-rst's to make server and/or client to drop the connection).

Current possible response pages seems to be (which you also can make your own versions of):

- Default Antivirus Response Page

- Default Application Block Page

- Default File Blocking Block Page

- Default URL Filtering Response Page

- Default Anti-Spyware Download Response Page

- Default Decryption Opt-out Response Page

- Captive Portal Comfort Page

- URL Filtering Continue and Override Page

- SSL VPN Login Page

- SSL Certificate Revoked Notify Page