How can i block user to connect wifi using Cortex

[Sulthan.Ibrahim]

We were using Symantec to block user's to connect Wifi. But using Cortex how can i block the wifi.

Can someone advice me on this. 

Thanks 

[Grady]

As far as I know, Cortex XDR does not support the function of blocking WIFI connection

[Sulthan.Ibrahim]

Thanks for the reply Grady

Is there any workaround for this? 

My scenario is i don't want my users to connect their office Pc's with personal hotspot and browse the internet. How can i block that 

Is there any solution for that ? 

[Grady]

If you have a Paloalto firewall as an exit, you can use GlobalProtect and enable Enforce GlobalProtect Connection for Network Access to ensure that you must dial into GlobalProtect to access the Internet
You can refer to the following connection step 4
https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-portals/custo...

If there is no Paloalto firewall, consider using desktop management software like Symantec for control

[neelrohit]

Hi @Sulthan.Ibrahim ,

If you are able to capture the specific device type GUID of the NIC card of your wifi device on the endpoint, you can create custom device type on Cortex XDR and add it to blocking under the "Device Configuration" profile of "Extension Policy Rules" of Cortex XDR. 

Steps:

1. Go to Endpoints Tab> Policy Management.
2. Under Settings> Device Configuration, click "Add Device"
3. Add the device name and GUID details
   
4. Once added, go to Device Configuration profile of your choice or create a new one.
5. Under Custom Device Type, select your device name and set the configuration to "Block" as shown below:
   

This should allow you to block the wifi device of your endpoint. If the idea is to block only the wifi device and not network connectivity, then this should ideally be helpful. Alternatively, if you want to firewall the endpoint for all types of network connectivity you can use host firewall for the same.

Hope this helps. Please mark the response as "Accept as Solution" if it helps with your query.

Regards

[Sulthan.Ibrahim]

Thanks for the update Neelrohit

So based on your solution i can add my office WIFI device GUID (Which i want to allow users to connect) in the exception where user can connect only to the added GUID devices not their personal hotspot..

Correct me if i am wrong. 

[neelrohit]

Hi @Sulthan.Ibrahim ,

You will have to add the GUIDs of the WIFI NIC of your endpoints to block the WIFI connection and not the NIC GUID of your wifi routers to do the blocking as the agent can block only connections on physical device contexts.

[neelrohit]

Hi @Sulthan.Ibrahim ,

Please mark the response as "Accept as Solution" if that was able to help you.