topic Can NGFW Block Trafic Depending on the client and source IP in Next-Generation Firewall Discussions

Can NGFW Block Trafic Depending on the client and source IP

pan_iv — Wed, 23 Jul 2025 19:37:32 GMT

Hello,

We have a requirement to control connections from local virtual machines (VMs) to public endpoints. Specifically, we need to enforce access policies based on:

The type of client submitting the request (e.g., web browser vs. desktop tool)
The IP address of the VM from which the request originates

Is it possible to implement such granular controls?

Thank you for your insights!

Re: Can NGFW Block Trafic Depending on the client and source IP

rmfalconer — Thu, 24 Jul 2025 21:28:35 GMT

Source IP address is easy, just put that in a security rule.

You should be able to create a custom application with signatures based on header information to identify the type of client. You would just have to inspect the traffic to find something to match that differentiates between browser vs tool.

Re: Can NGFW Block Trafic Depending on the client and source IP

nikoolayy1 — Fri, 25 Jul 2025 07:37:05 GMT

@rmfalconer suggestion is good as the User-Agent header can be used in such cases but don't think that this is a good security as there are dedicated WAF systems that use javascripts to verify if a user is bot/tool or web browser like the one in Prisma Cloud product.

For custom signatures you can take a look at:

How to Write Palo Alto Networks Custom Vulnerability and Application Signatures with Examples | Palo Alto Networks