topic How to block Android users on PAN FW in General Topics

How to block Android users on PAN FW

vineetagarwal — Wed, 10 Jan 2018 22:26:29 GMT

Hi Guys,

Is it feasible to block the users on our PAN FW for a specific manufacture or platform , let say to block windows or MAC or Android users ?

Please assist as I m new to this PAN FW ...

Regards

Vineet

Re: How to block Android users on PAN FW

OtakarKlier — Wed, 10 Jan 2018 22:32:16 GMT

Hello,

The only way I can think of would be HIP checks/profiles via a VPN connection.

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/host-information/about-host-information/how-does-the-gateway-use-the-host-information-to-enforce-policy

Regards,

Re: How to block Android users on PAN FW

BPry — Wed, 10 Jan 2018 22:56:44 GMT

@vineetagarwal,

One of the ways you could do something like this is through user-agent identfication attached to a custom vulnerability signature and assigning the vulnerability high enough that the traffic gets reset; just keep in mind that this isn't really a common use for this feature and you would likely have a large list of user-agent 'vulnerability' signature depending on what you are trying to do.

So for XP computers for example you would need to Pattern Match on http-req-headers and the pattern itself would be User-Agent:.+Windows NT 5\.[12]|User-Agent:.+Windows XP