topic Re: How I can Use host Firewall on Cortex XDR for blocked RDP conexion in Cortex XDR Discussions

How I can Use host Firewall on Cortex XDR for blocked RDP conexion

Rolando_Pena — Mon, 27 Nov 2023 20:16:59 GMT

Hi everyone, I'm new user of cortex.

I need your help to use Host Firewall on Cortex for block RDP coneccions and permit only some groups,

I can block it using port, but I need allow conexion for IT group, i created two rules, one blocked RDP ports on both directions for everybody and the other allow traffic, and the target of second policy is just for IT groups. the second rule is at the top but. This not workings...

I need integrate other app like cloud identity engine or I can do it only with cortex?

thanks you for your help with this topics

Best!

Re: How I can Use host Firewall on Cortex XDR for blocked RDP conexion

jtalton — Mon, 27 Nov 2023 22:47:21 GMT

Hello Rolando_Pena,

Please confirm that you don't have any 'allow' rules that might be conflicting, and that the policy is correctly targeting the agent/endpoints that you're testing. I suggest assigning a different profile to the policy for the IT group that is allowed access, and the endpoints that you are testing, then confirm the agent has checked in to receive the policy configuration.

You may enable "Report Matched Traffic" for troubleshooting:

Host Firewall for Windows • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documentation portal

If you found this answer helpful please select Accept as Solution.

Thank you

Re: How I can Use host Firewall on Cortex XDR for blocked RDP conexion

Vijisaga — Mon, 21 Jul 2025 02:11:19 GMT

Hello Jtalton,

If blocking only port 3389 in Cortex XDR’s Host Firewall is cutting off internet access. Is there any other solution?

Regards,

Viji S