Cortex XDR Host Firewall Rule evaluation

[Lakshminarayan]

Hi Team,

I have a doubt about Host Firewall rule evaluation. Let say i have a rule created to allow all internal application inbound traffic on specific port / Remote IP. In the same rule group if i create another outbound rule and action type : allow all outbound traffic on any port/IP how it will evaluate the rule. It means it will allow all outbound traffic right.

[susekar]

Hello @Lakshminarayan ,

Greetings for the day.

Yes, your understanding is correct. In this scenario, the Host Firewall will allow the outbound traffic.

The Cortex XSIAM/XDR Host Firewall evaluates rules using a top-down approach, where the first rule that matches the traffic criteria is applied.

Here is how the evaluation logic works for your specific example:

1. Direction Matching: The firewall checks the traffic direction (Inbound vs. Outbound) as a primary matching criterion. "Inbound" rules only match traffic initiating from a remote source to the local host, while "Outbound" rules match traffic initiating from the local host to a remote destination.
2. Sequential Processing:
   • When Outbound traffic is initiated, the firewall evaluates the first rule (your Inbound rule). Since the direction does not match (the traffic is Outbound, but the rule is Inbound), this rule is skipped.
   • The firewall proceeds to the next rule (your Outbound rule). The direction matches (Outbound), and since it is configured to "Allow all," the traffic matches and is Allowed.

Because the Inbound rule does not match the criteria for Outbound traffic, it does not block or interfere with it. The rules function independently based on the direction of the connection.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar