block thin clients traffic

[vusal_d]

in my organization more than 4000 thin clients  hp t5570e with Windows Embedded installed 

i really need to block their traffic to WAN  Desirably all traffic  

what is the best practicy of doing that

by OS, hostnmae (all of theor hostname starts with HP-XXXXXXXXXXXXX), or by mac address (mac also statc like ab:cd-ef:xx:xx)

any help would be greatly appreciated 

[lobstercreed]

I'm not sure there would be a way to do this by wildcard which seems preferable in your case, but I have done something like this at a smaller scale. 

If the hostnames are predictable, such as HP-ABCDEF01, HP-ABCDEF02, etc you could create FQDN objects for each one and add them to an address group and then use that group in your policies.  It is relatively easy to craft the CLI for adding objects en masse....I do mine in Excel. 

However, if the names are random (based on a serial number or some such) then you're back to the wildcard thing I guess and I'm not sure that can be done.  Do they all live in the same isolated subnet(s) or something that you could filter by?

[vusal_d]

lobstercreed wrote:

If the hostnames are predictable, such as HP-ABCDEF01, HP-ABCDEF02, etc you could create FQDN objects for each one and add them to an address group and then use that group in your policies.  It is relatively easy to craft the CLI for adding objects en masse....I do mine in Excel.

I don't think that it it good idea to create 4k adresses even with excel. All thin clients live within different subnets (VLANS) around the country and get their IP addresses by DHCP which renews IP addresses every 8 days

I saw the "hot to"s at fortigate cookbook to block traffic for WinXP. I guess if XP can be block by a signature there must a way to block WES2009 OS.

That's the way I prefer to achieve my goal.

[lobstercreed · Accepted solution]

If you can figure that out, more power to you.  I really don't know anything about application control signatures. 

Here's another idea that could work if you use a Windows 2012 or later DHCP server (probably others).  Create a DHCP policy that assigns addresses within a particular block only to those clients (you can do this by MAC address prefix like you mentioned).  Then create a much smaller list of address objects (one per VLAN) for each address range that you set aside for these clients, and use that in an address group, etc.

Again, this is something I've done in the past when trying to accomplish a similar goal, albeit at a smaller scale.