topic Re: Best practices for Wildfire in Next-Generation Firewall Discussions

WF

tinhnho — Sat, 06 May 2023 13:40:26 GMT

Hi guys,

Besides Monitor - Logs - Wildfire Submissions, where else must we check whether Wildfire is working?

Thanks All.

Re: Best practices for Wildfire

TomYoung — Thu, 04 May 2023 01:14:29 GMT

Great question. The PANW best practice is to "attach security profiles to all Security policy rules that allow traffic." This includes the WildFire security profile. See 1st paragraph -> https://docs.paloaltonetworks.com/best-practices/9-1/internet-gateway-best-practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles.

I use security profile groups so that I can make changes in the group rather than having to change every allow rule.

Thanks,

Tom

Re: Best practices for Wildfire

TomYoung — Thu, 04 May 2023 15:17:44 GMT

Hi @tinhnho ,

If the device is getting automatic updates and it is not configured in the template, then it is configured locally or pushed from Panorama. What is configured under Device > Dynamic Updates on the NGFW? What is configured under Panorama > Device Deployment > Dynamic Updates?

Thanks,

Tom

Re: Best practices for Wildfire

TomYoung — Thu, 04 May 2023 15:59:26 GMT

Hi @tinhnho ,

I'm sorry. I should have said Panorama > Device Deployment > Dynamic Updates > Schedules. Could you check that? Once we get that answer, then I can answer the other questions.

Thanks,

Tom

Re: Best practices for Wildfire

TomYoung — Thu, 04 May 2023 16:17:34 GMT

Hi @tinhnho ,

There it is! Panorama is downloading WildFire updates every 30 minutes ( Panaroma > Dynamic Updates ) and pushing it out to the NGFWs every 30 minutes ( Panorama > Device Deployment > Dynamic Updates > Schedules ). You can change the time interval in both places to change the schedule.

With regard to "How do we tell?", there should be logs somewhere, but I don't know off the top of my head.

Thanks,

Tom