topic Re: Host Firewall in Cortex XDR Discussions

Host Firewall

RamyashreeMada — Mon, 24 Jul 2023 02:44:08 GMT

Hello,

Can the Host firewall option be enabled?
If enabled, what are the impact?
Can this be considered as an alternate option for network segmentation?
If enabled, will be there be manual intervention needed to manage the firewall on endpoints?
What are the settings and usecases (rules) that can be created for the firewalls?

Re: Host Firewall

neelrohit — Mon, 24 Jul 2023 05:20:22 GMT

Thank you for writing to live community.

We have couple of discussions on the live community regarding host firewall implementation itself, I think it should help with your queries.

Kindly review the same:

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-host-firewall-behavior-question/m-p/542376#M4364

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/host-firewall/m-p/520019#M3079

Re: Host Firewall

RamyashreeMada — Mon, 24 Jul 2023 08:02:29 GMT

Hello,

What are the primary use-cases (rules) of host-based firewalls? When should we use this feature? Can anyone share any examples/use-cases?
Can this be considered as an alternate option for network segmentation?

Re: Host Firewall

neelrohit — Mon, 24 Jul 2023 09:58:52 GMT

Hi @RamyashreeMada ,

The use cases would vary from organisation to organisation. However, the primordial reason to use it is to enable endpoint level network restriction the same way as you would do using Windows Firewall. It will be used to restrict applications and services to block network connections to certain destinations or certain ports etc.

As a result, the need to make sure that endpoints are secured on network level if they are not managed via firewalls for network connection makes host firewall a vital feature.

Hope this helps!

Please mark the response as "Accept as solution" if it answers your query