Blocking OS specific traffic?

[bgranholm]

Does anyone know if there is a way to block traffic sourced from a specific OS in our network?

We were discussing legacy Windows XP machines. Since they are no longer supported or being updated it would be nice to be able to block them from the internet but allow internal connections to them. (We have a couple of legacy programs we need to keep for customers that either dont exist any more or were never updated to run on anything but windows XP)

We were thinking that we could just block them at the firewall but the firewall doesn't recognize OS that I know of.

We could certainly give them static IPs and block them based on that but it would be nice to be able to block traffic to any Windows XP machine on our network just by virtue of its OS.

Any thoughts?

Thanks,

Ben

[pulukas · Accepted solution]

For web applications there is a user posted solution for detecting the Windows XP agent and blocking access.

Custom vulnerability signature for identifying Windows XP clients

[bgranholm]

Thanks Steven, that is perfect!

[jkim2]

if a user changes the user agent which isnt' rocket science then this won't work. this will also only work for web traffic. Look into global protect HIPS or Forescout which is a technology partner with Palo Alto Networks or a NAC solution if you want them off the network.

[gafrol]

bgranholm schrieb:

We were thinking that we could just block them at the firewall but the firewall doesn't recognize OS that I know of.

GlobalProtect knows the OS 🙂 So does the Firewall