Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 12 replies
  • Subscribers 41 subscribers
  • Views 4376 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Firewall policy "drop" shows block page on HTTP connections

ILikeFirewalls

When I configure a policy to "drop" on all destination IPs and ports, I expect it to drop the traffic without notifying the user. However, I am receiving the "Stop! This website is blocked" page when I try to view any HTTP website. I would like it to drop the packets silently. How do I configure this?

I am running SFOS 18.0.1 MR-1-Build396



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    I think this is part of the expected behavior from Web > User notifications.

    I tested on my XG with the same build, a Drop rule would notify the user when browsing to HTTP (or decrypted HTTPS).

    If you add a Reject rule instead of Drop, then the user gets a TCP RST response from the firewall instead of the HTTP block page. Not a silent drop but no notification or web redirect to a block page.

    You can also add an Allow rule for HTTP with Deny All as Web Policy, then go to the Zone of the firewall and turn off the Captive Portal:

    System > Administration > Device Access > remove Captive Portal*

    Note: 

    Turning off access to captive portal stops user notifications from appearing. Example: Web filter and Sandstorm notification pages

    this is a little different than Reject (TCP RST) because the user might get redirected to the XG IPS block page (in the browser URL bar) but the page will not display.

    Ex: XG_HOSTNAME:8090/.../default

    hope that helps,

    Patrick

Reply
  • 0

    Hi,

    I think this is part of the expected behavior from Web > User notifications.

    I tested on my XG with the same build, a Drop rule would notify the user when browsing to HTTP (or decrypted HTTPS).

    If you add a Reject rule instead of Drop, then the user gets a TCP RST response from the firewall instead of the HTTP block page. Not a silent drop but no notification or web redirect to a block page.

    You can also add an Allow rule for HTTP with Deny All as Web Policy, then go to the Zone of the firewall and turn off the Captive Portal:

    System > Administration > Device Access > remove Captive Portal*

    Note: 

    Turning off access to captive portal stops user notifications from appearing. Example: Web filter and Sandstorm notification pages

    this is a little different than Reject (TCP RST) because the user might get redirected to the XG IPS block page (in the browser URL bar) but the page will not display.

    Ex: XG_HOSTNAME:8090/.../default

    hope that helps,

    Patrick

Children
Unfiltered HTML