topic Re: Running Cortex XDR firewall along with Windows Firewall in Cortex XDR Discussions

Running Cortex XDR firewall along with Windows Firewall

Andrew_Lim — Wed, 11 Oct 2023 01:37:10 GMT

Hi Community,

Just a general best practice question with Cortex XDR firewall. Should and do others run Windows firewall alongside Cortex XDR on Windows Servers or do you generally disable for easier management.

I understand that Windows firewall configuring will be painful as it'll be explicit to each server purpose, but just want to get a grasp on what's best practice, if Cortex XDR and co exist also.

Regards

Andrew

Re: Running Cortex XDR firewall along with Windows Firewall

abdrahman — Wed, 11 Oct 2023 01:55:36 GMT

Dear @Andrew_Lim

Thank you for reaching out to the live community. I understand you would like to run Windows defender firewall along side Cortex XDR firewall, however, to avoid performance issues, Palo Alto Networks recommends that you disable or remove Windows Defender from endpoints and where the Cortex XDR agent is installed. There are also other potential performance issues with having both XDR and Defender running together on an endpoint as there will be conflicts. Thank you.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: Running Cortex XDR firewall along with Windows Firewall

neelrohit — Thu, 12 Oct 2023 04:40:32 GMT

Hi @Andrew_Lim ,

After you install Cortex XDR agent on Windows endpoints, and if you enable host firewall rule on Cortex XDR, Windows firewall is automatically disabled.

Re: Running Cortex XDR firewall along with Windows Firewall

Andrew_Lim — Thu, 12 Oct 2023 23:07:00 GMT

Thank you Abdrahman, found the documentation that mentions this. Much appreciated.

Re: Running Cortex XDR firewall along with Windows Firewall

Andrew_Lim — Thu, 12 Oct 2023 23:09:34 GMT

Thankyou Neelrohit, I had a mpssvc issue on a laptop today and noticed this was indeed the outcome of reinstalling the agent.