An administrator would like to override the default deny action for a given application and instead would like to block the traffic and send the ICMP…

In Palo Alto Networks PAN-OS, the drop action in a Security Policy rule discards packets. However, this action can be modified by selecting the "Send ICMP Unreachable" option. When enabled, the firewall not only drops the traffic but also sends an ICMP Type 3, Code 13 message ("Communication Administratively Prohibited") back to the source host. This explicitly informs the source that the connection was blocked by a policy, which directly fulfills the administrator's requirement to override a default silent deny with a block that sends this specific ICMP code.

A. Drop: The standard drop action, without the "Send ICMP Unreachable" option, silently discards packets and sends no response to the source.

C. Reset both: This action is specific to TCP traffic and sends a TCP RST (reset) packet to both the client and the server, not an ICMP message.

D. Reset server: This action is specific to TCP traffic and sends a TCP RST (reset) packet only to the server, not an ICMP message to the source.

---

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2. In the section describing Security Policy actions

the guide specifies the behavior of the drop action: "Drop—Silently drops the traffic; the firewall does not send a response to the host or server. For a Security policy rule

you can also enable the Send ICMP Unreachable option. This option sends an ICMP code 3

type 13

'Communication Administratively Prohibited' message to the client."

Source: Palo Alto Networks Documentation

"Security Policy Actions

" PAN-OS Administrator's Guide 10.2. (Accessible via the official Palo Alto Networks technical documentation portal).

2. Palo Alto Networks PAN-OS® Administrator’s Guide 11.0. The documentation for the latest PAN-OS version reiterates this functionality

confirming its consistency across versions. The description for the drop action remains identical regarding the "Send ICMP Unreachable" option.

Source: Palo Alto Networks Documentation

"Security Policy Actions

" PAN-OS Administrator's Guide 11.0. (Accessible via the official Palo Alto Networks technical documentation portal).