Hi all. We have 60 XP machines I need to block from accessing the Internet. HOW? I am new to the PAN's so bear with me?

[ltosi]

Hi all.  We have 60 XP machines I need to block from accessing the Internet.  HOW?  I am new to the PAN's so bear with me?

[jay.martin]

Hi - I'm assuming you are not using GlobalProtect agents - if you were you could create a HIP object for the XP OS and target your rule that way.  Without GP, if your DNS performs well you could create an address group and put the FQDN's of the XP machines in, then do a deny rule to the Internet.  Or more preferably to take potentially slow/inaccurate DNS resolution out of the picture, if the XP machines have static IP addresses, or effectively static by DHCP reservation, you could do the same using the IP addresses instead of the FQDN's.  Hope this gives you some possible options.

[gwesson]

You might be able to create a custom signature for browser user-agent headers. It's no guarantee, but might be enough. The IE string is "Windows NT 5.1", and in other browsers it will probably list "XP". You'll probably want to make it case sensitive and search for strings online to help get a better picture.

Hope this helps,

Greg Wesson

[jay.martin]

This article may also prove helpful - https://live.paloaltonetworks.com/docs/DOC-6948

[ericgearhart]

ltosi - jay.martin's suggestion sounds like the best thing to do to me. You can even configure a "Block IP' under the Properties section of the Configuration tab, and set it to the max, 3600 seconds. Every time the user agent is seen the IP will be blocked for an hour.