Blocking Windows XP traffic

1. Enabling Application Control

2. Creating a custom application signature

Go to Security Profiles >  Application Control and select View Application Signatures in the upper right-hand corner. Create a new signature with the syntax presented here.

You can copy and paste this text into the Signature field.

F-SBID(--attack_id 8151; --vuln_id 8151; name "Windows.NT.5.Web.Surfing"; --default_action drop_session; --service HTTP; --protocol tcp; --app_cat 25; --flow from_client; --pattern !"FCT"; --pattern "Windows NT 5.1"; --no_case; --context header; weight 40; )

The signature will appear at the top of the application list in the Web.Client category.

 3. Adding the signature to the default Application Control profile 

Go to Security Profiles > Application Control and edit the default policy.

Under Application Overrides, select Add Signatures.

The new signature should appear at the top of the list. If it does not, search for the signature’s name (in the example, block-windows-nt5).

Select the signature, then click on Use Selected Signatures at the bottom of the page.

4. Adding the default profile to a security policy 

Go to Policy & Objects > IPv4 Policy and edit the policy that allows connections from the internal network to the Internet.

Under Security Profiles, enable Application Control and use the default profile.

5. Results

Go to Log & Report > Forward Traffic. Filter the results to show denied traffic.

You will see that the application control signature, Windows.NT.5.Web.Surfing, appears in the Application column and was used to block traffic from PCs running Windows XP (device writer-0735721d).