topic Re: Broker VM and direct connection in Cortex XDR Discussions

Broker VM and direct connection

Aristooo — Fri, 28 Mar 2025 10:03:55 GMT

Hi Dears,

I have configured a proxy on the endpoints to allow them to establish a connection with the Broker VM. Everything is working as expected, and the agents’ status shows as "Connected."

However, while reviewing the Network Firewall, I noticed that the agents are also simultaneously attempting to connect directly to Cortex XDR IP addresses (application: traps-management-service). Reference IP addresses: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Resources-Required-to-Enable-Access

Is it expected behavior for the agents to attempt direct connections to Cortex XDR IPs even when a proxy is configured and functioning properly on the endpoint?

Re: Broker VM and direct connection

jmazzeo — Fri, 28 Mar 2025 13:08:12 GMT

Hi @Aristooo,

That's an expected behavior. You can force the agents to only use the Proxy, but anyway sometimes you can see connection attempts to the tenant directly.

From the Agent Settings Profile assigned to the endpoints, you can change this setting:

If this post answers your question, please mark it as the solution.

Re: Broker VM and direct connection

Aristooo — Fri, 28 Mar 2025 13:18:11 GMT

Hi @jmazzeo ,

Thank you for your response. I will try it.