Display contextual information on HTTP response pages
Configure the Cloud-Delivered Firewall Management Center to dynamically display session-specific details on HTTP response pages when a Firewall Threat Defense device blocks traffic. This improves communication by providing the user with clear reasons for access denial, aiding troubleshooting.
-
You can customize HTTP block pages with dynamic variables that reflect real-time session data.
-
This configuration applies to HTTP block pages configured within Cloud-Delivered Firewall Management Center access control policies, including Security Intelligence block rules.
|
Dynamic variable |
Description |
Default value |
|---|---|---|
|
|
Username associated with the session. |
(empty) |
|
|
URL requested by the user. |
(empty) |
|
|
Requested URL in percent-encoded format. |
(empty) |
|
|
Primary category of the URL that triggered the matched rule. |
"Unknown" |
|
|
All categories associated with the URL. |
"Unknown" |
|
|
Reputation label of the URL. For more information about reputation, refer to Web Reputation Levels. |
"Unknown" |
|
|
Combined client and web application names identified by AppID. |
"Client: Unknown, Web app: Unknown" |
|
|
Client application name |
"Unknown" |
|
|
Web application name |
"Unknown" |
|
|
Source IP address |
(empty) |
|
|
Source port |
"0" |
|
|
Country name of the source IP address. |
"Unknown" |
|
|
Destination IP address |
(empty) |
|
|
Destination port |
"0" |
|
|
Country name of the destination IP address. |
"Unknown" |
|
|
Protocol used in the HTTP block session. Displays the protocol name for common protocols and numeric IP protocol number for uncommon protocols. |
This variable always has a value in every HTTP block page served. |
|
|
VLAN identifier |
"0" |
|
|
Access control rule ID |
"0" |
|
|
Revision number of the access control rule. |
"0" |
|
|
Indicates whether the matched rule includes an application or protocol constraint. This flag is "true" if the rule specifies application identification (AppID) constraints, ensuring the block page reflects that the rule is application-aware. |
"false" |
|
|
Indicates whether the matched rule includes a URL category constraint ( |
"false" |
|
|
Indicates whether the matched rule includes any URL constraint, such as custom URL, URL category, reputation, or reputation-unknown rules. This flag is "true" for any rule involving URL-based conditions beyond just category constraints. |
"false" |
If a variable has no value during a block event, the HTTP block page shows a preset default value. If there is no preset default value, the field appears empty.