Block Mobile Devices

[rob.burgoyne]

I was wondering if anyone has created a custom app-id to identify mobile devices to create policies around. For example block all mobile devices getting to the internet, or apply a QoS policy ect.

Thanks,

[mikand]

I dont think there is any reliable way to do this.

You could watch for "user-agent" string (which the mobile device owner can change) and tcp windowssizes being used (which can also be changed).

One way is to do the other way around - use globalprotect to identify which box is which and based on this information (like a whitelist) you can QoS those into a higher prio. Or captive portal (but this wouldnt stop mobile devices).

Another way could be if you have an AD and configure userid to only allow the specific AD-group containing your approved devices (based on machine accounts).

[rmonvon]

To add on to mikand's suggestion, check out this post on detecting iPhone/iPad:  https://live.paloaltonetworks.com/docs/DOC-1503.  Thanks.