Some websites such as stubhub.com, ticketmaster.com,
or dollartree.com, block traffic from the cloud IP address range.
When users who are secured by Prisma Access attempt to access
these websites, they can be denied access with the following message
on the web browser:
You don't have permission to access "http://www.dollartree.com/"
on this server
Palo Alto Networks reviews all reported sites. If an access
issue is found, Palo Alto Networks categorizes the site and adds
an egress policy which changes the IP address of the site. When
users access a site using a different IP address, their first attempt
might be unsuccessful because the client is expected to receive
a TCP RST packet, which causes modern browsers to auto-retry the
connection and successfully load the site.
If, after 48 hours, the website continues to be blocked even
after a retry operation, verify that you have configured security
policy to allow the user to access the specific website/web category.
After confirming that your acceptable use policy allows the requested
web content, open a Support Case with Palo
Alto Networks Technical Support for assistance with the impacted
traffic flow, specifying the steps taken to isolate the issue.