topic Re: Palo Alto Scan Clients for Antivirus in General Topics

Palo Alto Scan Clients for Antivirus

MarkTan — Fri, 31 Jan 2014 22:46:12 GMT

Hello,

I have a quick question regarding the capabilities of the Palo Alto's. In this scenario, we want to be able to deny computers who connect via SSL VPN (GlobalProtect) access to the network if they do not have antivirus on their machines. Can Palo Alto do this? If so, can you direct me to the procedures of how to set this up?

Thanks,

Mark

Re: Palo Alto Scan Clients for Antivirus

ialeksov — Fri, 31 Jan 2014 23:37:55 GMT

Hi Mark,

You can use HIP checks to do this.

You will need to configure HIP object for the AV solutions that you want the firewall to check for, than create a HIP profile and to assign the profile to a security rule (this is selected in the Users tab of the security policy).

Please check this article. It is for widows patches, but the principle is the same.

How to Configure HIP for Missing Microsoft Patches

Hope this helps

Re: Palo Alto Scan Clients for Antivirus

MarkTan — Sun, 02 Feb 2014 04:18:34 GMT

Does this also work for Macs?

Re: Palo Alto Scan Clients for Antivirus

ialeksov — Sun, 02 Feb 2014 12:55:16 GMT

Yes Mark,

You can used it for the mac's too.

If you like you can divide the checks for MAC and for Windows machines in separate IP Profiles, where one can be checking if the system has Windows OS, and an AV solution running (and/or up to date), and another HIP Profile that will check if the system is MAC OS and there is and an AV solution running (and/or up to date). For that reason when creating the HIP object, in the GENERAL tab, mark the Host info and select the OS as needed (mac or win), and if needed limit the versions that are in usage in your environment (maybe you are only using windows 7 Professional and windows 8.1 for the Microsoft OS and Mac OS X 10.8 from Apple). After that make the needed combination of HIP objects into HIP Profiles (using logical operators) and attache the profile to to a security rule. Dont forget to add block rule for the users that dont have the HIP profile, or at least limit them to just be able to go to certain sites (like the update server for the AV solution in use).