Prisma Cloud Compute: How to resolve "firewall failed to monitor traffic for <target> on port bind: An attempt was made to access a socket in a way forbidden by its access permissions"

Prisma Cloud Compute: How to resolve "firewall failed to monitor traffic for <target> on port bind: An attempt was made to access a socket in a way forbidden by its access permissions"

96
Created On 01/31/26 23:56 PM - Last Modified 07/14/26 18:48 PM


Symptom


  • Setting up WAAS on Windows Host (In-line mode) 
  • WAAS doesn't seem to working
  • Error in defender.log file
    • ERRO 2025-11-07T12:28:02.345 agent_manager.go:674 Failed to send error to defender firewall failed to monitor traffic for <host> on port 8445: listen tcp :443: bind: An attempt was made to access a socket in a way forbidden by its access permissions. rpc error: code = Canceled desc = grpc: the client connection is closing


Environment


  • Prisma Cloud Compute Self-Hosted 
  • Prisma Cloud SaaS 
  • WAAS on Windows Server (Host In-line mode)


Cause


-The error message means that port 443 (or whichever port is given to WAAS) is already occupied by another process/service, and hence, WAAS needs to be given a vacant port.

 


Resolution


  1. Open your Windows Server PowerShell as Administrator.
  2. Run the following command: netstat -ano | findstr :443 (or any other port being used)
  3. You'll see something like below as output: 

                    TCP    0.0.0.0:443    0.0.0.0:0    LISTENING    1234

      Here PID=1234

      4. Find which process/service is associated with this port other than WAAS/defender.
      5. Either remove the other process or move WAAS to another empty port.
          This should help resolve the error.



Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000wkS7KAI&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail