topic Re: Blocking MAC OSX on Palo Alto in General Topics

Blocking MAC OSX on Palo Alto

imranshahid — Mon, 18 Sep 2017 16:29:23 GMT

Hi All,

I have a scenario where i would like to block users on the basis of os they are using. Example, if someone is using OSX, they should be blocked. Any suggestions if that can be achieved.

Kind regards

Imran

Brighton

Re: Blocking MAC OSX on Palo Alto

BPry — Mon, 18 Sep 2017 18:45:48 GMT

@imranshahid,

So you should actually be able to do this perfectly fine through the use of broswer user-id agents and custom vulerability signatures. There's a really handy writeup of doing this for a Windows XP client using user-agent here and there is a full list of user agents for OS X maintained here

Setthing the vulnerability siganture default action and severity depending on your vulerability protection profile will reset the traffic, essentially making it so OS X is blocked.

Re: Blocking MAC OSX on Palo Alto

imranshahid — Tue, 19 Sep 2017 07:57:45 GMT

thats why too lenghty and complex process. It there any other way around blocking mac osx.

Re: Blocking MAC OSX on Palo Alto

kiwi — Tue, 19 Sep 2017 08:40:47 GMT

Hi @imranshahid,

You can enforce HIP checks (host information profile). HIP can check on OS version and enforce policy .

https://www.paloaltonetworks.com/documentation/71/pan-os/web-interface-help/globalprotect/objects-globalprotect-hip-objects

However, if you found the previous suggestion too complex/lengthy then I doubt you will like this solution.

Cheers !

-Kiwi.