09-06-2018 01:27 PM
I am currenlty doing a proof-of-concept test for the Credential Theft Protection feature. SSL decryption is configured and working. I can get the system to re-direct to the Anti Phishing Continue Page. However, that page uses the SSL cert associated with the Management SSL/TLS Service Profile. The browser will show the URL block page as https://98.136.144.138:6081/php/credentialblock.php?vsys=1<redacted>. Note that the IP seen here is for yahoo, not the IP of the firewall. As a result, we get an SSL error because the cert doesn't match the domain in the URL. If you add an exception for the site you will be able to view the Anti Phishing Continue page, but of course you would have to do this every time you got blocked. Is there a setting in the PAN that will have it use its own IP for the credentialblock.php page? Or is there a way to have this page served over http and not https?
02-27-2024 02:33 AM
FYI:Using the "URL Admin Override" redirect method solved this issue.
Configure URL Admin Override - Knowledge Base - Palo Alto Networks
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
