Cortex XDR Host Firewall behavior Question

[AmmarJi]

Hi Everyone,

I am trying to configure host firewall using Cortex XDR, in the documentation, it mentions:

The Cortex XDR host firewall rules leverage the operating system firewall APIs and enforce these rules on your endpoints, but not your Windows or Mac firewall settings.

Device Control • Cortex XDR Prevent Administrator Guide • Reader • Palo Alto Networks documentation ...

Which I understood that it will not affect the Local Windows Firewall.

I proceeded with configuring following the steps, and once I created a profile rule, I got the below message:

You have assigned a non-default HFW profile. This will move control from Windows FW to Cortex HFW and Windows firewall rules will no longer apply (agent version 7.5 and above).

Does this mean that it will disable Windows built-in firewall? Since I willing to run Cortex Firewall to be applied only on external network for certain IPs. Will this disable all the rules applied by Windows Local Firewall?

Regards,

Ammar

[neelrohit · Accepted solution]

Hi @AmmarJi ,

Thank you for writing to live community!

When we talk about using the host firewall using Cortex XDR, the agent uses the same APIs used by Windows Native host firewall ie. the Windows filtering platform. Because we blend well with native environment on the Windows side, we use the same APIs and as a result, we disable the Windows firewall as a feature. This means that the rules on the Windows native firewall will be disabled once the rules on Cortex XDR host firewall is activated. 

Hope this answers your query. 

Regards,

[AmmarJi]

Hi Neelrohit,

So in case we have rules applied on the Native Windows Firewall, we will need to migrate and apply the same rules on Cortex XDR to achieve the same configuration?

Ammar,

[neelrohit]

That is correct. If you have windows native firewall rules enabled, you might want to import those and add it to Cortex XDR host firewall rules.

[AmmarJi]

Thank you for the answer.