Need help creating a Host Firewall rule in Cortex XDR

[RicardoWaffle]

Hi all.

I am migrating from SEP host firewall to Cortex XDR host firewall. I have an existing rule in SEP to allow EAPoL, I need to know how to set up the same rule in Cortex XDR. In SEP, the protocol is specified as "Ethernet" with a protocol type of "0x888e". Cortex XDR does not have "Ethernet" for a protocol.

What protocol do I use in Cortex XDR for this rule? Can I enter in the protocol type in Hex or do I need to convert it?

Thanks!

[neelrohit · Accepted solution]

Hi @RicardoWaffle ,

Thank you for writing to live community!

Cortex XDR operates on the network layer and not L2 and hence we do not have the option to add ethertypes to the host firewall rules. However, you can select custom protocols from the drop down within the rule and add the protocol number(0-255) which supposedly fits in EAPOL service to be added to Cortex XDR to set up rules of your choice. If you have a radius exchange EAP then you can also use the UDP on port 1812 for rule definition as a combinational parameter.
Try referring here: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
Hope this helps

[RicardoWaffle]

Thanks for the explanation Neelrohit.