Blocking page for https traffic

[VinceM]

Hi all,

We are currently on PA-2050 in version 5.0.9.

Creating Web secur profile for test categorie (with PAn-DB).

If trying to access blocked page in http => block page (NICE !!)

If trying to access blocked page in https => Page "session has been reste" - default browser block page.

Would like to have the palo block page everytime.

Can you help me to configure that ?

Thx in advance.

V.

[HULK · Accepted solution]

Could you please confirm that Decryption policy is configured on the PAN FW or not, if not, then you have to configure:

• A certificate on the PAN Device. One of the following:
  • A self-signed/self-generated certificate which is a CA certificate configured for Forward Trust / Forward Untrust use (as relevant to deployment requirements)
    Note: if using a self-signed/sef-generated certificate it will be necessary to import this certificate into the client machine's certificate store to avoid unwanted browser certificate errors
  • An intermediate CA certificate installed on the PAN Device which was generated by an organization's internal CA also configured for Forward Trust / Forward Untrust use

Even though you haven't configured a decryption policy, The PAN firewall will internally decrypt the packet to push the BLOCK page notification in front of the end user, during handshake.

How to Configure the Palo Alto Networks Device to Serve a URL Response page Over an HTTPS Session wi...

But, as per my experience, you will get the best result with a decryption policy.

Thanks

[VinceM]

Hi Hulk,

thx for your answer. Will test that as faster as possible 🙂

cheers.

v.