Interactive blocking with HTTP response pages

Interactive blocking with HTTP response pages is a security mechanism that

  • allows users to load an originally requested site after reading a warning page,

  • provides user control over whether to proceed with potentially blocked traffic, and

  • enables temporary bypass with configurable duration settings.

Configuration behavior and bypass settings

When you configure interactive blocking, users may have to refresh after bypassing the response page to load page elements that did not load.

Tip

To quickly disable interactive blocking for the whole access control policy, display neither the system provided page nor a custom page. The system then blocks all connections without interaction.

If a user does not bypass an interactive block, matching traffic is denied without further inspection. If a user bypasses an interactive block, the access control rule allows the traffic, although the traffic may still be subject to deep inspection and blocking.

By default, a user bypass is in effect for 10 minutes (600 seconds) without displaying the warning page on subsequent visits. You can set the duration to as long as a year, or you can force the user to bypass the block every time. This limit applies to every Interactive Block rule in the policy. You cannot set the limit per rule.

Logging options for interactively blocked traffic are identical to those in allowed traffic. If a user does not bypass the interactive block, the system can log only beginning-of-connection events. When the system initially warns the user, it marks any logged beginning-of-connection event with the Interactive Block or Interactive Block with reset action. If the user bypasses the block, additional connection events logged for the session have an action of Allow.