topic Re: WildFire analysis report rabbit images in General Topics

WildFire analysis report rabbit images

CHOE-KyungJun — Fri, 24 Jun 2022 02:32:16 GMT

Dear Team,

When my client clicks on the WildFire analysis reprot, they see the rabbit image as shown below.

Has anyone had the same experience as me?

I would like to know the cause of the symptom and how to solve it.

Thanks in advance,
Kyungjun,

Re: WildFire analysis report rabbit images

Adrian_Jensen — Fri, 24 Jun 2022 16:54:45 GMT

There is currently a bug in the Wildfire Analysis Report tab that causes a "refused to connect" error when trying to view the report. It is caused by an iframe permissions problem in the PA web coding, which is fixed in the most recent PANOS release.

https://live.paloaltonetworks.com/t5/threat-vulnerability-discussions/wildfire-reports-refuse-to-connect/td-p/468990

It looks like your client has configured a custom browser error page, using a "rabbit" background image instead of the default "sad page" image. Can you confirm with them that they made this custom change?

Re: WildFire analysis report rabbit images

jmhwang — Sat, 25 Jun 2022 08:08:32 GMT

Hello Team, the image is not configured in the default browser. It looks like this in all browsers, is there a workaround? Do you have any images with bug fixes?

Re: WildFire analysis report rabbit images

Adrian_Jensen — Sat, 25 Jun 2022 18:43:18 GMT

If it is not a custom error page in the browser, then it must be a custom error page in the PaloAlto. But I would suspect the browser first. In the PaloAlto custom error/blocked pages can be setup from:

Device -> Response Pages

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/device/device-response-pages

However, changing the response page is not going to fix the problem. It is a web coding error in the page that causes a security block. The Wildfire Analysis Report tab is an iframe within the Wildfire Monitor page and the HTML explicitly blocks iframes.

This is known PaloAlto bug PAN-183826 which affects PANOS multiple versions. There are recently released fixes for the bug in versions:

9.1.14

10.0.9

10.1.??? - No fix yet? Not listed in release notes.

10.2.1

There is a workaround which is to extract the URL to the iframe and copy/paste it into a new browser window. From your PaloAlto, right click in the Wildfire Analysis Report tab and select "View frame source".