Need help creating a Host Firewall rule in Cortex XDR

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Need help creating a Host Firewall rule in Cortex XDR

L1 Bithead

Hi all.

I am migrating from SEP host firewall to Cortex XDR host firewall. I have an existing rule in SEP to allow EAPoL, I need to know how to set up the same rule in Cortex XDR. In SEP, the protocol is specified as "Ethernet" with a protocol type of "0x888e". Cortex XDR does not have "Ethernet" for a protocol.

What protocol do I use in Cortex XDR for this rule? Can I enter in the protocol type in Hex or do I need to convert it?

Thanks!

1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

Hi @RicardoWaffle ,

 

Thank you for writing to live community!

 

Cortex XDR operates on the network layer and not L2 and hence we do not have the option to add ethertypes to the host firewall rules. However, you can select custom protocols from the drop down within the rule and add the protocol number(0-255) which supposedly fits in EAPOL service to be added to Cortex XDR to set up rules of your choice. If you have a radius exchange EAP then you can also use the UDP on port 1812 for rule definition as a combinational parameter.
Try referring here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
Hope this helps

View solution in original post

2 REPLIES 2

L4 Transporter

Hi @RicardoWaffle ,

 

Thank you for writing to live community!

 

Cortex XDR operates on the network layer and not L2 and hence we do not have the option to add ethertypes to the host firewall rules. However, you can select custom protocols from the drop down within the rule and add the protocol number(0-255) which supposedly fits in EAPOL service to be added to Cortex XDR to set up rules of your choice. If you have a radius exchange EAP then you can also use the UDP on port 1812 for rule definition as a combinational parameter.
Try referring here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
Hope this helps

Thanks for the explanation Neelrohit.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!