File Blocking action "Continue" does not work when a file is uploaded
Symptom
In the File Blocking Profile, it is possible to configure the action "Continue" for the "Upload" direction. However, when a file is uploaded to a web server, the continue page does not appear.
In this case, action "Alert" is taken instead of "Continue", thus as a result the file gets uploaded and a log is generated with action "Alert".
Environment
- Palo Alto Networks NGFW
- File Blocking Profile
Cause
The "Continue" action is not supported for the "Upload" stream in File Blocking. The reason is because there is no way to force the browser to re-POST the file even if the "Continue" action is taken and the "Continue" button is clicked by a user. Thus, the action "Continue" is downgraded to action "Alert" for "Upload" streams by the firewall by design.
Resolution
If you want to use the "Continue" action in File Blocking, please to use it for only the "Download" stream.