About fmd

Thanks for replying! So are we saying that if it's an upload to a website we won't see the Block page! But if it's a download we would?! I've tried this in IE and FF and the same result so it doesn't appear to be down to the browser. It's not my area of expertise but I would have expected a block page to appear regardless of the direction of the file up/down? ... View more

Hi - just resurrecting this query as it's still outstanding. When I do a wireshark trace on the client and upload the file from my client to the end server - I can see the http 503 page with the "AV blocked" message (from the Palo Alto) being sent from the end server IP back to my client (along the TCP session that the Eicar virus is found in). However, I never see it in the browser. ... View more

Hi - as stated in my last post. We've now done this with the same client but they are now sat in the office the Palo Alto is also in the same office - just an internal router hop away - so they are NOT going via the ssl vpn solution and we get the same result. It's would take a bit more effort to get the file onto the web servers to retrive the other way (I don't personally have access to them - and neither does the client who is testing). ... View more

Hi We've not tested this with no ASA in the way. So we have client-----Palo-----Web server with the same result. The clients connect to the web server on a non-standard port. The rule is set to block on virus. They connect and authenticate to the page fine - then go to a page which has a "browse" button to load the Eicar file onto the site. The page hangs - but no block page is presented to the client. The PA shows that the Eicar virus was detected and blocked. So end to end it's working - they just never get the block page. ... View more

Hi - just ressurecting this one!! We have implimented the block on AV for a specific rule for some browser based traffic and the PA log shows that we have a "deny" for the Eicar test file - but the end user never gets the response page. As stated before we have client connecting over SSL VPN to an ASA - all traffic comes from the source IP of the ASA. The PA then sits in front of the end web server. Any advice!!? ... View more