topic Re: Blocking OS specific traffic? in General Topics

Blocking OS specific traffic?

bgranholm — Tue, 24 Jun 2014 13:55:28 GMT

Does anyone know if there is a way to block traffic sourced from a specific OS in our network?

We were discussing legacy Windows XP machines. Since they are no longer supported or being updated it would be nice to be able to block them from the internet but allow internal connections to them. (We have a couple of legacy programs we need to keep for customers that either dont exist any more or were never updated to run on anything but windows XP)

We were thinking that we could just block them at the firewall but the firewall doesn't recognize OS that I know of.

We could certainly give them static IPs and block them based on that but it would be nice to be able to block traffic to any Windows XP machine on our network just by virtue of its OS.

Any thoughts?

Thanks,

Ben

Re: Blocking OS specific traffic?

pulukas — Tue, 24 Jun 2014 14:05:34 GMT

For web applications there is a user posted solution for detecting the Windows XP agent and blocking access.

Custom vulnerability signature for identifying Windows XP clients

Re: Blocking OS specific traffic?

bgranholm — Tue, 24 Jun 2014 14:57:16 GMT

Thanks Steven, that is perfect!

Re: Blocking OS specific traffic?

jkim2 — Tue, 24 Jun 2014 15:26:34 GMT

if a user changes the user agent which isnt' rocket science then this won't work. this will also only work for web traffic. Look into global protect HIPS or Forescout which is a technology partner with Palo Alto Networks or a NAC solution if you want them off the network.

Re: Blocking OS specific traffic?

gafrol — Wed, 25 Jun 2014 13:16:28 GMT

bgranholm schrieb:

We were thinking that we could just block them at the firewall but the firewall doesn't recognize OS that I know of.

GlobalProtect knows the OS 🙂 So does the Firewall