topic Need help creating a Host Firewall rule in Cortex XDR in Cortex XDR Discussions

Need help creating a Host Firewall rule in Cortex XDR

RicardoWaffle — Tue, 24 Jan 2023 22:43:07 GMT

Hi all.

I am migrating from SEP host firewall to Cortex XDR host firewall. I have an existing rule in SEP to allow EAPoL, I need to know how to set up the same rule in Cortex XDR. In SEP, the protocol is specified as "Ethernet" with a protocol type of "0x888e". Cortex XDR does not have "Ethernet" for a protocol.

What protocol do I use in Cortex XDR for this rule? Can I enter in the protocol type in Hex or do I need to convert it?

Thanks!

Re: Need help creating a Host Firewall rule in Cortex XDR

neelrohit — Wed, 25 Jan 2023 03:01:07 GMT

Hi @RicardoWaffle ,

Thank you for writing to live community!

Cortex XDR operates on the network layer and not L2 and hence we do not have the option to add ethertypes to the host firewall rules. However, you can select custom protocols from the drop down within the rule and add the protocol number(0-255) which supposedly fits in EAPOL service to be added to Cortex XDR to set up rules of your choice. If you have a radius exchange EAP then you can also use the UDP on port 1812 for rule definition as a combinational parameter.
Try referring here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
Hope this helps

Re: Need help creating a Host Firewall rule in Cortex XDR

RicardoWaffle — Wed, 25 Jan 2023 16:19:17 GMT

Thanks for the explanation Neelrohit.