block thin clients traffic

Forum|Forum|7 years ago
January 30, 2019
3 replies
3674 views

in my organization more than 4000 thin clients hp t5570e with Windows Embedded installed

i really need to block their traffic to WAN Desirably all traffic

what is the best practicy of doing that

by OS, hostnmae (all of theor hostname starts with HP-XXXXXXXXXXXXX), or by mac address (mac also statc like ab:cd-ef:xx:xx)

any help would be greatly appreciated

Best answer by lobstercreed

If you can figure that out, more power to you. I really don't know anything about application control signatures.

Here's another idea that could work if you use a Windows 2012 or later DHCP server (probably others). Create a DHCP policy that assigns addresses within a particular block only to those clients (you can do this by MAC address prefix like you mentioned). Then create a much smaller list of address objects (one per VLAN) for each address range that you set aside for these clients, and use that in an address group, etc.

Again, this is something I've done in the past when trying to accomplish a similar goal, albeit at a smaller scale.

lobstercreed

New Member

I'm not sure there would be a way to do this by wildcard which seems preferable in your case, but I have done something like this at a smaller scale.

If the hostnames are predictable, such as HP-ABCDEF01, HP-ABCDEF02, etc you could create FQDN objects for each one and add them to an address group and then use that group in your policies. It is relatively easy to craft the CLI for adding objects en masse....I do mine in Excel.

However, if the names are random (based on a serial number or some such) then you're back to the wildcard thing I guess and I'm not sure that can be done. Do they all live in the same isolated subnet(s) or something that you could filter by?

vusal_dAuthor

New Member

lobstercreed wrote:
If the hostnames are predictable, such as HP-ABCDEF01, HP-ABCDEF02, etc you could create FQDN objects for each one and add them to an address group and then use that group in your policies. It is relatively easy to craft the CLI for adding objects en masse....I do mine in Excel.

I don't think that it it good idea to create 4k adresses even with excel. All thin clients live within different subnets (VLANS) around the country and get their IP addresses by DHCP which renews IP addresses every 8 days

I saw the "hot to"s at fortigate cookbook to block traffic for WinXP. I guess if XP can be block by a signature there must a way to block WES2009 OS.

That's the way I prefer to achieve my goal.

lobstercreedAnswer

New Member

If you can figure that out, more power to you. I really don't know anything about application control signatures.

Here's another idea that could work if you use a Windows 2012 or later DHCP server (probably others). Create a DHCP policy that assigns addresses within a particular block only to those clients (you can do this by MAC address prefix like you mentioned). Then create a much smaller list of address objects (one per VLAN) for each address range that you set aside for these clients, and use that in an address group, etc.

Again, this is something I've done in the past when trying to accomplish a similar goal, albeit at a smaller scale.

Sign up

Login with SSO

Login to the community

Login with SSO