Running Cortex XDR firewall along with Windows Firewall

[Andrew_Lim]

Hi Community,

Just a general best practice question with Cortex XDR firewall. Should and do others run Windows firewall alongside Cortex XDR on Windows Servers or do you generally disable for easier management. 

I understand that Windows firewall configuring will be painful as it'll be explicit to each server purpose, but just want to get a grasp on what's best practice, if Cortex XDR and co exist also.

Regards

Andrew

[abdrahman]

Dear @Andrew_Lim 

Thank you for reaching out to the live community. I understand you would like to run Windows defender firewall along side Cortex XDR firewall, however, to avoid performance issues, Palo Alto Networks recommends that you disable or remove Windows Defender from endpoints and where the Cortex XDR agent is installed. There are also other potential performance issues with having both XDR and Defender running together on an endpoint as there will be conflicts. Thank you.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[neelrohit · Accepted solution]

Hi @Andrew_Lim , 

After you install Cortex XDR agent on Windows endpoints, and if you enable host firewall rule on Cortex XDR, Windows firewall is automatically disabled.

[Andrew_Lim · Accepted solution]

Thank you Abdrahman,  found the documentation that mentions this. Much appreciated.

[Andrew_Lim]

Thankyou Neelrohit, I had a mpssvc issue on a laptop today and noticed this was indeed the outcome of reinstalling the agent.