Misread that initially. Can you show the blocking event it is matching?

I would assume that this was a connectivity issue, did you rule that out?

Certain. See the traffic decryption section of the 5.4.1 user guide: http://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401.html

With the 5.4.x version of code you can perform SSL encryption/decryption and apply policy.

Because you have chosen the interactive block it allows the client to 'click through' or simply refresh their webpage and essentially ignore the blocking action. What is likely happening for you is that the browser is automatically refreshing and reb...