topic How can i block user to connect wifi using Cortex in Cortex XDR Discussions

How can i block user to connect wifi using Cortex

Sulthan.Ibrahim — Sun, 29 Jan 2023 06:46:39 GMT

We were using Symantec to block user's to connect Wifi. But using Cortex how can i block the wifi.

Can someone advice me on this.

Thanks

Re: How can i block user to connect wifi using Cortex

Grady — Sun, 29 Jan 2023 08:53:23 GMT

As far as I know, Cortex XDR does not support the function of blocking WIFI connection

Re: How can i block user to connect wifi using Cortex

Sulthan.Ibrahim — Sun, 29 Jan 2023 09:34:19 GMT

Thanks for the reply Grady

Is there any workaround for this?

My scenario is i don't want my users to connect their office Pc's with personal hotspot and browse the internet. How can i block that

Is there any solution for that ?

Re: How can i block user to connect wifi using Cortex

Grady — Sun, 29 Jan 2023 09:43:30 GMT

If you have a Paloalto firewall as an exit, you can use GlobalProtect and enable Enforce GlobalProtect Connection for Network Access to ensure that you must dial into GlobalProtect to access the Internet
You can refer to the following connection step 4
https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-portals/customize-the-globalprotect-app

If there is no Paloalto firewall, consider using desktop management software like Symantec for control

Re: How can i block user to connect wifi using Cortex

neelrohit — Mon, 30 Jan 2023 07:06:21 GMT

Hi @Sulthan.Ibrahim ,

If you are able to capture the specific device type GUID of the NIC card of your wifi device on the endpoint, you can create custom device type on Cortex XDR and add it to blocking under the "Device Configuration" profile of "Extension Policy Rules" of Cortex XDR.

Steps:

Go to Endpoints Tab> Policy Management.
Under Settings> Device Configuration, click "Add Device"
Add the device name and GUID details
Once added, go to Device Configuration profile of your choice or create a new one.
Under Custom Device Type, select your device name and set the configuration to "Block" as shown below:

This should allow you to block the wifi device of your endpoint. If the idea is to block only the wifi device and not network connectivity, then this should ideally be helpful. Alternatively, if you want to firewall the endpoint for all types of network connectivity you can use host firewall for the same.

Hope this helps. Please mark the response as "Accept as Solution" if it helps with your query.

Regards

Re: How can i block user to connect wifi using Cortex

Sulthan.Ibrahim — Mon, 30 Jan 2023 05:54:43 GMT

Thanks for the update Neelrohit

So based on your solution i can add my office WIFI device GUID (Which i want to allow users to connect) in the exception where user can connect only to the added GUID devices not their personal hotspot..

Correct me if i am wrong.

Re: How can i block user to connect wifi using Cortex

neelrohit — Mon, 30 Jan 2023 06:14:09 GMT

Hi @Sulthan.Ibrahim ,

You will have to add the GUIDs of the WIFI NIC of your endpoints to block the WIFI connection and not the NIC GUID of your wifi routers to do the blocking as the agent can block only connections on physical device contexts.

Re: How can i block user to connect wifi using Cortex

neelrohit — Tue, 07 Feb 2023 15:00:09 GMT

Hi @Sulthan.Ibrahim ,

Please mark the response as "Accept as Solution" if that was able to help you.