topic Re: Wildfire reports refuse to connect in Advanced Threat Prevention Discussions

Wildfire reports refuse to connect

ChetanR — Sun, 27 Feb 2022 09:39:58 GMT

Hi Team,

We are facing an error in wildfire reports after updagrade to 10.0.8h4 . it says wildfire reports refuse to connect.

Please suggest any solution to check but if i updgrade to 10.1.3 it is working fine in mylab.

Regards

Chetan

Re: Wildfire reports refuse to connect

Adrian_Jensen — Fri, 18 Mar 2022 15:54:21 GMT

Did you get any response from PA on this? For the first time ever, we got a hit in Wildfire for a file last night. But when trying to review the Wildfire report I am also getting a "refused to connect" error. Running version 9.1.12.

Re: Wildfire reports refuse to connect

Adrian_Jensen — Fri, 18 Mar 2022 16:41:39 GMT

Digging thru the webcode, it appears to be something wrong in the javascript or firewall. The Wildfire Analysis Report tab tries to pull a file from:

hxxps://<firewall>/wf_report/private/wildfire.paloaltonetworks.com/443/xxx/panos/...

That then tries to redirect to:

hxxps://wildfire.paloaltonetworks.com/443/xxx/panos/report/9.0/<encoded string>

which fails with a file-not-found error. The URL is screwed up/not parsed correctly. Removing the "443/xxx/" you get the correct Wildfire report.

hxxps://wildfire.paloaltonetworks.com/panos/report/9.0/<encoded string>

I suspect the "xxx" is the failure point, something not parsed correctly in the javascript, which then fails to be interpreted in the firewall redirect.

Re: Wildfire reports refuse to connect

ChetanR — Fri, 01 Apr 2022 22:24:17 GMT

I reproduced this issue in version 10.0.8-h4. After further searching, this is a known issue affecting version 10.0.8. As stated in the following KB, this issue was fixed in PAN-OS version 10.0.9.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004N9oCAE

Re: Wildfire reports refuse to connect

Adrian_Jensen — Fri, 01 Apr 2022 22:48:54 GMT

Interesting, I can't even find that KB by searching the expected terms. The only relevant thing that comes up is this thread in the community forums. Looking at the 9.1 release notes I don't see anything about wildfire or iframe fixes either (though I don't see it in the 10.0.9 release notes either).

Re: Wildfire reports refuse to connect

Adrian_Jensen — Mon, 11 Apr 2022 17:11:38 GMT

After opening a TAC case, this is apparently known issue PAN-183826 (doesn't show up in any Known Issues list). It also affects 9.1.x, in addition to 10.0, and is expected to be fixed in the 9.1.14 release.

Re: Wildfire reports refuse to connect

RingoCheung — Fri, 20 May 2022 14:54:03 GMT

I'm on 10.1.5 h2 and have same problem.

Re: Wildfire reports refuse to connect

Adrian_Jensen — Mon, 06 Jun 2022 04:36:26 GMT

9.1.13 was released a couple days ago. I haven't upgraded to it yet, but the release notes still don't show anything for PAN-183826, either fixed or known issue. Likewise, the 10.1 release notes don't have anything...

The ultimate problem is that the PA interface has security webcode to prevent opening iframes within the secure page. The Wildfire Analysis Report tab tries to show the Wildfire PDF report in an iframe... As a workaround you can extract the report URL from the iframe source code and open it in a new browser window.

Re: Wildfire reports refuse to connect

RingoCheung — Fri, 20 May 2022 17:28:32 GMT

I notice the same issue when going to help page from any ? icon, the left pane where the menu is, shows same behavior, "refused to connect" I've opened a TAC case. Restarting the management service did not resolve the issue.

Re: Wildfire reports refuse to connect

ookawa — Thu, 02 Jun 2022 07:55:39 GMT

I heard from TAC that PaloAlto will soon update the PAN-OS 9.1.14 release notes to include PAN-183826.

Re: Wildfire reports refuse to connect

RingoCheung — Thu, 02 Jun 2022 14:17:56 GMT

Worked with TAC on 10.1.5 h2 the workaround provided below (using Chrome):
--> Navigated to Monitor->WildfireSubmissions->WildfireAnalysis Report
--> Right-click on it and select view frame source.
--> Remove the view-source from the URL
>> After completing the above workaround, we would be able to generate the report.

Re: Wildfire reports refuse to connect

ymiyashita — Mon, 06 Jun 2022 01:39:27 GMT

PAN-183826 was added to PAN-OS 9.1.14 release note.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-addressed-issues/pan-os-9-1-14-addressed-issues#panos-addressed-issues-9.1.14
PAN-183826 - "Fixed an issue where, after clicking WildFire Analysis Report, the web interface failed to display the report with the following error message: refused to connect."