Can NGFW Block Trafic Depending on the client and source IP

[pan_iv]

Hello,

We have a requirement to control connections from local virtual machines (VMs) to public endpoints. Specifically, we need to enforce access policies based on:

• The type of client submitting the request (e.g., web browser vs. desktop tool)
• The IP address of the VM from which the request originates

Is it possible to implement such granular controls? 

Thank you for your insights!

[rmfalconer · Accepted solution]

Source IP address is easy, just put that in a security rule.

You should be able to create a custom application with signatures based on header information to identify the type of client. You would just have to inspect the traffic to find something to match that differentiates between browser vs tool.

[nikoolayy1 · Accepted solution]

@rmfalconer  suggestion is good as the User-Agent header can be used in such cases but don't think that this is a good security as there are dedicated WAF systems that use javascripts to verify if a user is bot/tool or web browser like the one in Prisma Cloud product.

For custom signatures you can take a look at:

How to Write Palo Alto Networks Custom Vulnerability and Application Signatures with Examples | Palo...