Not able to set Proxy for Windows 2012 servers

Shashanksinha — Thu, 03 Nov 2022 11:16:13 GMT

Hello ,

We are unable to see few servers in our endpoint list. But the user confirmed it has cortex installed in it and is enabled also particularly For Windows 2012 servers we're not able to set the proxy and for some hosts last seen connected date is being shown for a previous date.

Kindly suggest how can we set proxy for these servers.

Re: Not able to set Proxy for Windows 2012 servers

neelrohit — Thu, 03 Nov 2022 11:42:13 GMT

Hi @Shashanksinha ,

Thank you for writing to live community!

Before I jump to the solution, I would like to know the connection status of those endpoints and also if those Windows 2012 servers are in the same subnet?

Considering the above answer as disconnected or even connected and servers in the same subnet, it is very likely that the servers may be in a network subnet where firewall rules may not have been whitelisted correctly and the agent though connects to the cloud, is not able to receive updates from the cloud server.

In this case, the best mechanism is to set the proxy manually on the endpoints using the CLI. Command line syntax listed below:

C:\Program Files\Palo Alto Networks\Traps\cytool proxy set <IP/FQDN:Port#>

You will be prompted for uninstall password, supply the uninstall password and it should work on the next checkin. If not, please stop and start the agent again. IP/FQDN should be supplied for the broker VM as applicable.

You can also use a batch file using scripts to run the command with password as shown below:

echo <Unintstall Password>|"C:\Program Files\Palo Alto Networks\Traps\cytool.exe" proxy set "IP/FQDN:Port"

If you are on agent version 7.7.x or above then you can also use a token hash instead of password for security purpose.

Hope this helps!

topic Re: Not able to set Proxy for Windows 2012 servers in Cortex XDR Discussions

Not able to set Proxy for Windows 2012 servers

Re: Not able to set Proxy for Windows 2012 servers