Blocking page for https traffic

cancel
Showing results for 
Search instead for 
Did you mean: 

Blocking page for https traffic

L5 Sessionator

Hi all,

We are currently on PA-2050 in version 5.0.9.

Creating Web secur profile for test categorie (with PAn-DB).

If trying to access blocked page in http => block page (NICE !!)

If trying to access blocked page in https => Page "session has been reste" - default browser block page.

Would like to have the palo block page everytime.

Can you help me to configure that ?

Thx in advance.

V.

1 ACCEPTED SOLUTION

Accepted Solutions

L7 Applicator

Could you please confirm that Decryption policy is configured on the PAN FW or not, if not, then you have to configure:

  • A certificate on the PAN Device. One of the following:
    • A self-signed/self-generated certificate which is a CA certificate configured for Forward Trust / Forward Untrust use (as relevant to deployment requirements)
      Note: if using a self-signed/sef-generated certificate it will be necessary to import this certificate into the client machine's certificate store to avoid unwanted browser certificate errors
    • An intermediate CA certificate installed on the PAN Device which was generated by an organization's internal CA also configured for Forward Trust / Forward Untrust use

Even though you haven't configured a decryption policy, The PAN firewall will internally decrypt the packet to push the BLOCK page notification in front of the end user, during handshake.

How to Configure the Palo Alto Networks Device to Serve a URL Response page Over an HTTPS Session wi...

But, as per my experience, you will get the best result with a decryption policy.

Thanks

View solution in original post

2 REPLIES 2

L7 Applicator

Could you please confirm that Decryption policy is configured on the PAN FW or not, if not, then you have to configure:

  • A certificate on the PAN Device. One of the following:
    • A self-signed/self-generated certificate which is a CA certificate configured for Forward Trust / Forward Untrust use (as relevant to deployment requirements)
      Note: if using a self-signed/sef-generated certificate it will be necessary to import this certificate into the client machine's certificate store to avoid unwanted browser certificate errors
    • An intermediate CA certificate installed on the PAN Device which was generated by an organization's internal CA also configured for Forward Trust / Forward Untrust use

Even though you haven't configured a decryption policy, The PAN firewall will internally decrypt the packet to push the BLOCK page notification in front of the end user, during handshake.

How to Configure the Palo Alto Networks Device to Serve a URL Response page Over an HTTPS Session wi...

But, as per my experience, you will get the best result with a decryption policy.

Thanks

View solution in original post

Hi Hulk,

thx for your answer. Will test that as faster as possible :-)

cheers.

v.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!