Decryption rule blocking actions

decryption rule blocking actions provide different termination methods to control connection handling.

Available blocking actions

The system provides these decryption rule actions for traffic you do not want to pass through the system:

  • Block: Terminates the connection, resulting in an error in the client browser. The error message does not indicate the site was blocked due to policy. Instead, errors might indicate that there are no common encryption algorithms. It is not obvious from this message that you blocked the connection on purpose.

  • Block with reset: Terminates and resets the connection, resulting in an error in the client browser. The error indicates the connection was reset but does not indicate why.

Tip

You cannot use the Block or Block with reset action in a passive or inline (tap mode) deployment because the device does not directly inspect the traffic. If you create a rule with the Block or Block with reset action that contains passive or inline (tap mode) interfaces within a security zone condition, the policy editor displays a warning (The diagram illustrates the process of blocking a connection with a reset action, highlighting the resulting error message displayed in the client browser.) next to the rule.