cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
7223
Views
5
Helpful
4
Replies

How to block user agent?

adminseginfo
Level 1
Level 1

Hi!

I would like to block Custom user agents in Ironport Web Security without blocking IE.

User Agents.jpg

How can I do this to:

Chrome,

Safari,

Firefox,

Opera,

My WebOS 7.0

4 Replies 4

edadios
Cisco Employee
Cisco Employee

Hello Wilke,

You can check the access log for the user agents you want to block, and configure for those.

To find user agent:

a) Browser to

GUI -> "System Administration" -> "Log Subscription" -> 'Access logs'

b) Add

%u

in the Custom fields

c) Submit and commit the changes

Then

d) Grep or tail the access logs based on client IP address

e) The user agent string should be located at end of the access log line

Here is a close example, though this is doing authentication bypass:

http://tinyurl.com/m5kf9c

Then instead of configuring for bypass authentication, configure an access policy that will block all traffic from this identity.

I hope this infomratiom helps you.

Regards,

Eric

The problem with your example is the all browsers including IE will present the user agent Mozilla so in essence you would block I.E. as well. Take a look at the site http://www.useragentstring.com/ or http://www.user-agents.org/index.shtml to find more information. Be careful what you ask for

Hi Tommy, use two access rules:

1) Useragent IE allow traffic

2) User agent all deny traffic

Hope this helps.

Chris

Jeff Ferrell
Level 1
Level 1

I found on some site for Flex Regex to do this to block Android.

(\w*)Android(\w*)

Could add the iOS devices in a similar fashion, if you must get more granular, you can, just avoid version numbers as I assume they change often.

Oh the site is here: http://www.stratulat.com/Regular_Expressions_Flex.html

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: