Such a firewall could even have learned to block Linux user agents on its own. Similar to how some spam filters learn what email headers are associated with spa

Such a firewall could even have learned to block Linux user agents on its own. Similar to how some spam filters learn what email headers are associated with spammers. So if the firewall is seeing a lot of bad traffic with “X11; Linux” in their UA strings and little normal traffic with that in their UA strings then the firewall will take the presence of that as an indicator of possibly bad traffic.