topic Hi all. We have 60 XP machines I need to block from accessing the Internet. HOW? I am new to the PAN's so bear with me? in General Topics

Hi all. We have 60 XP machines I need to block from accessing the Internet. HOW? I am new to the PAN's so bear with me?

ltosi — Wed, 02 Apr 2014 13:14:34 GMT

Hi all. We have 60 XP machines I need to block from accessing the Internet. HOW? I am new to the PAN's so bear with me?

Re: Hi all. We have 60 XP machines I need to block from accessing the Internet. HOW? I am new to the PAN's so bear with me?

jay.martin — Thu, 03 Apr 2014 16:55:02 GMT

Hi - I'm assuming you are not using GlobalProtect agents - if you were you could create a HIP object for the XP OS and target your rule that way. Without GP, if your DNS performs well you could create an address group and put the FQDN's of the XP machines in, then do a deny rule to the Internet. Or more preferably to take potentially slow/inaccurate DNS resolution out of the picture, if the XP machines have static IP addresses, or effectively static by DHCP reservation, you could do the same using the IP addresses instead of the FQDN's. Hope this gives you some possible options.

Re: Hi all. We have 60 XP machines I need to block from accessing the Internet. HOW? I am new to the PAN's so bear with me?

gwesson — Thu, 03 Apr 2014 18:31:46 GMT

You might be able to create a custom signature for browser user-agent headers. It's no guarantee, but might be enough. The IE string is "Windows NT 5.1", and in other browsers it will probably list "XP". You'll probably want to make it case sensitive and search for strings online to help get a better picture.

Hope this helps,

Greg Wesson

Re: Hi all. We have 60 XP machines I need to block from accessing the Internet. HOW? I am new to the PAN's so bear with me?

jay.martin — Tue, 06 May 2014 17:14:07 GMT

This article may also prove helpful - https://live.paloaltonetworks.com/docs/DOC-6948

Re: Hi all. We have 60 XP machines I need to block from accessing the Internet. HOW? I am new to the PAN's so bear with me?

ericgearhart — Tue, 06 May 2014 21:00:17 GMT

ltosi - jay.martin's suggestion sounds like the best thing to do to me. You can even configure a "Block IP' under the Properties section of the Configuration tab, and set it to the max, 3600 seconds. Every time the user agent is seen the IP will be blocked for an hour.