How to disable firewall from contacting hawkeye.*

[MYazid]

Hello,

I notice that the firewall that we have is making very frequent contact with hawkeye.services-edge.paloaltonetworks.com. I would like to stop this. Have disabled App-ID Cloud Engine via Device>Setup>ACE but this does not stop the traffic.

PANOS 11.1.10-h1

Any idea?

[kiwi]

Hi @MYazid ,

Is it enabled in other areas ?

The URL hawkeye.services-edge.paloaltonetworks.com is used by Palo Alto Networks firewalls for secure cloud connectivity related to services like DLP, AppID Cloud Engine, and Advanced Threat Prevention for threat analysis.

Also here:

Configure the Content Cloud FQDN Settings 

Why do we see paloalto-dlp-service traffic generated from a firewall without a DLP license or config... 

Hope this helps,

-Kim.

[MYazid]

Hello Kim,

Thanks. I have disabled wherever configuration that I can find. I have also disabled the ATP License, so now it is only running on TP License.

Under Device>Setup>Content-ID, there is a section "Content Cloud Settings" that has reference to hawkeye.services-edge.paloaltonetworks.com. But this field cannot be left blank.

Is there a way to stop this traffic?