GlobalProtect(GP) Client detects windows firewall as disabled even when it is enabled.

• When Windows Firewall "Is Enabled Yes" is set as a condition in a HIP object/profile used in a security policy.
• Traffic stops hitting desired security policy with such HIP Profile/Object as match condition.
• On a Windows computer, Windows firewall is enabled.
• However, while collecting HIP reports, GlobalProtect(GP) Client detects the windows firewall as disabled.

• Palo Alto Firewalls
• Supported PAN-OS
• GlobalProtect Gateway
• GlobalProtect (GP) App
• HIP enforced policies
   

• Windows Firewall has open rule permitting "allow all" or "permit any" or similar.
• When this is the case, OPSWAT/GP Client will detect it as Windows firewall disabled.

1. Remove the open rules on Windows making it somewhat closed.

Example below shows screenshot of Windows Defender Firewall:

2. The rules indicate allow all condition with any program and any source/destination match.
3. Remove this and any such rules.
4. Resubmit the HIP information from GP App.