topic Denied URL - Broker VM in Cortex XDR Discussions

Denied URL - Broker VM

MarcoMJ — Fri, 08 Dec 2023 21:52:47 GMT

Hi team!

Does anyone have or have had a situation where the applet local agent settings show "Denied url: URL_HERE"?

Sometimes for short periods of time (around 5 -30 seconds) our broker VMs turn on in red the applet and we can see the message "Denied urls: ch-<xdr-tenant> .traps.paloaltonetworks.com "

The URLs denied are different, sometimes is ch-<xdr-tenant> .traps.paloaltonetworks.com other times is dc-<xdr-tenant>.traps.paloaltonetworks.com or cc-<xdr-tenant>.traps.paloaltonetworks.com

As we can see, they are URLs from this documentation:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Resources-Required-to-Enable-Access

We have allowed all the resources, so, we don't understand why the URLs could be denied.

All comments are very welcome. Thank you!

Re: Denied URL - Broker VM

abdrahman — Mon, 11 Dec 2023 06:52:33 GMT

Dear @MarcoMJ ,

Thank you for reaching out to Live community. From the description I see that you are seeing access denied for the broker VM for a very short amount of time (5 to 30 seconds), in such situations I would suggest you to please check on the firewall rules if any of these URLs are missing on the whitelist . Also, please check if DNS is working properly and there is no SSL Decryption getting in the way. Thank you.

Also, if you can please confirm if this issue is persistent or does it happen only some times? Thank you.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: Denied URL - Broker VM

MarcoMJ — Wed, 13 Dec 2023 16:55:54 GMT

Hi Abdrahman,

I requested to the team verify the firewall rules and they said that everything is fine, all the resources are on the whithelist, also, they verify DNS and is the same situation, is fine.

Re: Denied URL - Broker VM

O.Lingamol578195 — Wed, 26 Nov 2025 08:47:07 GMT

Hello @ abdrahman ,

Even I am getting the same issue of denied URLs in Local Agent Settings and after checking and verifing with Network and Firewall Team, there is nothing been restricted or prevented from their end, they hav allowed all the URLs. Kindly share what could be the exact issue here !