> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-local-agent-settings.md). # Activate Local Agent Settings {% hint style="info" %} **License** This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that includes endpoints or Cortex Cloud Runtime Security. {% endhint %} The Local Agent Settings applet on the Palo Alto Networks Broker VM enables you to:
Deploy the Broker VM proxy To deploy Cortex XSIAM in restricted networks where endpoints do not have a direct connection to the internet, setup the Broker VM to act as a proxy that routes all the traffic between the Cortex XSIAM management server and XDR agents/XDR Collectors via a centralized and controlled access point. This enables your agents and XDR Collectors to receive security policy updates, upgrades, and send logs and files to Cortex XSIAM without a direct internet connection. The Broker VM acts like a transparent proxy and doesn’t decrypt the secure connection between the server and the XDR agent/XDR Collectors, and hides the XDR agent’s/XDR Collector's original IP addresses. If your network topology includes SSL decryption in an upstream proxy/firewall, the Broker VM does not participate in the trust relationship as it is not initiating the connection to the server to be fully transparent. {% hint style="info" %} **Note** When routing traffic through a Broker VM proxy that sits behind a firewall, you may experience intermittent agent disconnections if the firewall is configured to drop challenge ACK reset (RST) packets. For environments using a Palo Alto Networks Next-Generation Firewall (NGFW), see [this Knowledge Base article](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boBJCAY) for details on managing this behavior via the Allow Challenge Ack setting. {% endhint %}
Enable broker caching To reduce your external network bandwidth loads, you can cache XDR agent installations, upgrades, and content updates on your Cortex XSIAM Broker VM. Every 15 minutes, the Broker VM retrieves the latest installers and content files from Cortex XSIAM, downloading them only if they are not already stored locally. The Broker VM stores this content for 7 days and agent installers for up to 30 days from the agent's last request. If the files were not available on the Broker VM at the time of the ask, the agent proceeds to download the files directly from the Cortex XSIAM server.
Requirements Before you activate the Local Agent Settings applet, verify the following prerequisites and limitations listed by the main features. **General** The Local Agent Settings applet on the Broker VM is capable of supporting: * Up to 28,000 agents for an Agent Proxy running on a Broker VM deployed prior to February 22, 2026. * Up to 50,000 agents for an Agent Proxy running on a Broker VM deployed after February 22, 2026. * Up to 10,000 agents for Content Caching. This is assuming a standard hardware setup with 2vCPU 8 GB memory. **Agent Proxy** * Supported with Traps agent version 5.0.9 and Traps agent version 6.1.2 and later releases. * Broker VM supports forwarding the XDR Collectors request URLs on all Broker VM versions. * Supported with all XDR Collector versions. Broker VMs can act as as a proxy for routing XDR Collector traffic to the Cortex XSIAM tenant. The Broker VM does not cache XDR Collector installers. * The Agent Proxy can also act as a proxy for other brokers. It supports all the data that brokers send to the server, including the logs they collect, using the Cortex Broker VM applets. **Agent Installer and Content Caching** * Supported with XDR agent version 7.4 and later releases and Broker VM 12.0 and later. * Requires a Broker VM with a minimum of an 8-core processor and increase the disk space allocated for data storage to 1024 GB to support caching for 10,000 agents. For more information, see Increase Broker VM storage allocated for data caching. * For the agent installer and content caching to work properly, you must configure different settings where the instructions differ depending on whether you are configuring a standalone Broker VM or High Availability (HA) cluster. **Standalone broker** * FQDN: A FQDN must be configured for the standalone broker as configured in your local DNS server. This is to ensure that XDR agents know who to access to receive agent installer and content caching data. * SSL certificates: Ensure you upload strong cipher SHA256-based SSL certificates when you setup the Broker VM. For more information, see Set up and configure Broker VM. * Download source: Requires adding the Broker VM as a download source in your Agent Settings Profile. **HA cluster** * FQDN: A FQDN must be configured in the cluster settings as configured in your local DNS server, which points to a Load Balancer. This ensures that the XDR agents turn to the load balancer to route the requests for the agent installer and content caching data to the correct broker. For more information on configuring the Load Balancer FQDN in a HA cluster, see Configure High Availability Cluster. * SSL certificates: In each broker in the cluster, ensure you upload strong cipher SHA256-based SSL certificates when you setup the Broker VM. For more information, see Set up and configure Broker VM. * Download source: Requires adding the cluster as a download source in your Agent Settings Profile. **Agent communication with Broker VM** Agents communicate with the Broker VM using Hypertext Transfer Protocol Secure (https) over port 443. You must ensure this port is open so that the Broker VM is accessible to all agents that are configured to use its cache. **Broker communication with cloud manager** The broker needs to communicate with the same URLs that the agents communicate with to avoid receiving any inaccessible URLs errors. For a complete list of the URLs that you need to allow access, see Enable access to required PANW resources.
How to activate the Local Agent Settings applet After you configure and register your Palo Alto Networks Broker VM, proceed to set up your Local Agent Settings applet. 1. Select **Settings** → **Configurations** → **Data Broker** → **Broker VMs**. 2. In either the **Brokers** tab or the **Clusters** tab, locate your Broker VM. 3. (Optional) To set up the Agent Proxy: a. Right-click the Broker VM and select **Configure**. Ensure your proxy server is configured. If not, add it as described in Set up and configure Broker VM. b. In the **APPS** column, select **Add** → **Local Agent Settings**. c. In the **Activate Local Agent** configuration, set **Proxy** to **Enabled**. Specify the **Port**. You can also configure the **Listening Interface**. The default is **All**.

Note

When you install XDR agents, configure the Broker VM IP address and port number. You can use port 8888 or a custom port. You cannot use ports 0–1024, 63000–65000, 4369, 5671, 5672, 5986, 6379, 8000, 9100, 15672, or 25672. You also cannot reuse ports assigned to the Syslog Collector applet.

4. (Optional) To set up Agent Installer and Content Caching: a. Ensure you uploaded your SHA256-based certificates. If not, upload them as described in Set up and configure Broker VM and **Save**. b. Specify the Broker VM FQDN. Right-click the Broker VM and select **Configure**. Under **Device Name**, enter your Broker VM **FQDN**. Configure this FQDN record in your local DNS server.

Important

A FQDN must be configured for WEC and Agent Installer and Content Caching to work properly.

c. Activate the Local Agent Settings applet on the Broker VM. Right-click the Broker VM and select **Add App** → **Local Agent Settings**. Alternatively, in the **APPS** column, select **Add** → **Local Agent Settings**. d. Activate installer and content caching. In the **Activate Local Agent** configuration, set **Caching** to **Enabled**.

Important

You can enable Agent Installer and Content Caching only after uploading a signed SSL Server Certificate and key, and setting the FQDN. For more information, see the Agent Installer and Content Caching requirements above.

e. To enable agents to use Broker VM caching, add the Broker VM as a download source in your Agent Settings profile. Select the Broker VMs to use. Ensure the profile is associated with a policy for your target agents. 5. After a successful activation, the APPS field displays Local Agent Settings with a green dot indicating a successful connection. Left-click the Local Agent Settings connection to view the applet status and resource usage.\ To help you easily troubleshoot connectivity issues for a Local Agent Settings applet on the Palo Alto Networks Broker VM, Cortex XSIAM displays a list of Denied URLs. These URLs are displayed when you left-click the Local Agent Settings applet to view the Connectivity Status. As a result, in a situation where the Local Agent Settings applet is reported as activated with a failed connection, you can easily determine the URLs that need to be allowed in your network environment. 6. Manage the local agent settings. After the local agent settings have been activated, left-click the Local Agent Settings connection in the APPS column to display the settings, and select: * **Configure** to change your settings. * **Deactivate** to disable the local agent settings altogether.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/generic-on-premise-data-collectors/broker-vm-data-collector-applets/activate-local-agent-settings.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.