Denying Internet Connection Sharing

[Conde01]

Hi,

I've recently discovered that if a user shares their network connection by setting up an AP on their machine (think Mac 'Sharing') then whatever device is then connected can get online (the deny and allow policies still apply as expected). For example, a connecting iPad gets an address 10.0.0.3/32 from the workstation AP. The workstaion has 192.168.1.5. The Activity logs show the  source IP as being 192.168.1.5. Is it possible to block the iPad (or see the 'real' source IP - 10.0.0.3/32). Hope that's clear.

Thanks

Nick

[rmonvon]

You can try this:  https://live.paloaltonetworks.com/docs/DOC-1503

[Conde01]

Thanks for the suggestion, but I don't want to block them, rather restrict tethered devices.

Thanks

[mharding · Accepted solution]

The short answer is no, the Mac is NAT'ing the 10.x.x.x network to it's real address of 192.168.x.x. The Palo Alto has no knowledge of this NAT. It only sees the 192.168.x.x address.

You could either secure the Mac desktops to prevent that behavior, or block based on User Agents.