FW stops forwarding files to WF 500

AmitKa79 — Thu, 16 Mar 2023 16:09:19 GMT

Hi,

We have a PA-5250 that suppose to send files to a WF-500 appliance.

Both are at 10.2.3 version.

The FW suddenly stopped sending file to our private wildfire cloud.

When we checked the "wildfire-upload.log" we see the following:

"cancelled - first"

"cancelled - concurrent file limit"

"cancelled - by DP"

Does anyone knows what can be the reason for the forwarding cancellations based on the logs provided?

If needed, I might be able to provide other logs as well.

Thanks

Amit

Re: FW stops forwarding files to WF 500

nikoolayy1 — Wed, 22 Mar 2023 09:49:59 GMT

Have you checked the hard disks on the firewall and wildfire appliance?

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-troubleshooting-and-investigating-full-hard/td-p/411960

Also you can just be hitting a limit on the firewall or wildfire appliance for fileuploads or someone to have configured a limit. If the issue you are seeing happens only during working hours, where there is a lot of traffic and files then probably it is a device/license limits.

Check the articles below:

https://docs.paloaltonetworks.com/wildfire/9-1/wildfire-admin/submit-files-for-wildfire-analysis/firewall-file-forwarding-capacity-by-model

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGoCAK

topic FW stops forwarding files to WF 500 in Next-Generation Firewall Discussions

FW stops forwarding files to WF 500

Re: FW stops forwarding files to WF 500