topic Re: Cortex - many aged-out connections on 35.244.133.254 in General Topics

Cortex - many aged-out connections on 35.244.133.254

RezhoPsq — Mon, 23 Feb 2026 09:52:54 GMT

Hello,
We are experiencing a high number of aged-out connections from our Cortex agents and brokers on 35.244.133.254.
When the connection is successful, the app-id traps-management-service is detected by our firewall.
Do you also encounter this behavior?
Thanks !

Re: Cortex - many aged-out connections on 35.244.133.254

Brandon_Wertz — Mon, 23 Feb 2026 21:17:58 GMT

@RezhoPsq wrote:

Hello,
We are experiencing a high number of aged-out connections from our Cortex agents and brokers on 35.244.133.254.
When the connection is successful, the app-id traps-management-service is detected by our firewall.
Do you also encounter this behavior?
Thanks !

@RezhoPsq My guess that address 35.244.133.254 is a part of Cortex's infra. That IP space is registered to GPC and Palo uses GPC for a lot of their services. Also, if you look through your system logs you'll see other services like URL and others connecting to "35" addresses registered to GPC.

Re: Cortex - many aged-out connections on 35.244.133.254

RezhoPsq — Tue, 24 Feb 2026 08:26:57 GMT

Yes no doubt about it : Enable access to required PANW resources • Cortex XDR 3.x Documentation • Palo Alto Networks documentation portal

But why so many TCP aged-out ? Generally, it means there's a network problem.