About Remo

Hi community Quite often we have issues with cortex xdr on citrix infrastructure. Currently meinly with windows server 2022 we are in the situation where it is not possible to run cortex at all because of possibel servercrashes which are not yet analyzed and resolved. So we needed to - at least temporary - change to microsoft defender. I wanted to ask here what are your solutions to let cortex xdr run properly on citrix servers without bothering the user too much? Do you use exceptions for different paths or specific configurations? Would be great to collect some informations on how to do this properly as I assume this could also help others here.   Looking forward to your replies 🙂 Remo ... View more

Hi community   Since about 2 weeks a vm firewall started getting problems with random crashes. Our setup is a firewallcluster but so far the active firewall crashes almost completely silent. At least the firewall does not initiate a failover to the passive node. So far we had about 4 crashes at random times and in one case the firewall crashed "hard" enough that it rebooted and this way the passive firewall took over.   TAC is already analyzing the situation. So far it is still very unclear (and frustrating). It seems to be related to the application cloud engine. This is also the current recommendation / action plan: we should disable the ACE completely for the moment. Obviously we did not buy this subscription for fun - we actively use these additional App-IDs from the SaaS Inline subscription. Disabling this of course will lead to the next issues. These issues will may be no longer be crashes but the traffic control obviously will be restricted.   At this point on one side I wanted to warn you as there seems to be a critical issue in PAN-OS in combination with SaaS Inline and application cloud engine (ACE). As we were told, this issue was introduced in code starting with PAN-OS 10.1. On the other side I wanted to ask if you had similar or the same issue already and if you maybe found a solution/workaround for this already (which was not disabling the feature completely)?   Have a great weekend Remo ... View more