topic Re: Free wildfire in General Topics

Free wildfire

jdprovine — Fri, 28 Aug 2015 20:15:12 GMT

I thought there was a limited version of wildfire that you could use for PE files. But it isn't working, I do a test registration and it fails. Is there something that is missing in the instruction that I have

https://live.paloaltonetworks.com/t5/Articles/Wildfire-Configuration-Testing-and-Monitoring/ta-p/57722

Re: Free wildfire

OtakarKlier — Fri, 28 Aug 2015 20:18:39 GMT

Make sure you have a valid and up to date Threat Prevention license and definitions.

Re: Free wildfire

jdprovine — Fri, 28 Aug 2015 21:01:27 GMT

I do. I have a subcription for three years

Re: Free wildfire

OtakarKlier — Fri, 28 Aug 2015 21:04:05 GMT

If its failing, then I would recommend you contact support. Such as in my case, it was something they had to do but was not documented on the support portal and I cant recall the solution.

Re: Free wildfire

jdprovine — Fri, 28 Aug 2015 21:07:13 GMT

This is not resolved why is it marked as resolved

Re: Free wildfire

Lucky — Sat, 29 Aug 2015 06:03:27 GMT

Hi Jprovine,

answer is simple: you won't be able to configure Wildfire service without having a license for it. You can stop trying, it won't work, and TAC can't help with that. Wildfire service is sandbox that proactively runs your code in the virtual machine before it is delivered to your end-user, that is a licensed service and you will not be able to fully use it until you purchase a license.

Here is the Wildfire admin guide: https://live.paloaltonetworks.com/t5/Articles/WildFire-Administrator-s-Guide-6-1-English/ta-p/54977

on page 4, there is a flowchart, I recommend opening and reading it. You were told in the other thread that you will benefit from Wildfire even if you don't have the license, but it did not catch your eye how; thing is - PAN analyses Wildfire reports from all customers that participate in cloud or that allow forwarding from their appliances, any and all malware cought in the previous period will be included into the next AV update. Those are updated frequently, and will be delivered to your device on the daily basis, meaning that you will not be more than 24 hours late to benefit from Wildfire service indirectly.

At the bottom right end of the said flowchart, you see what happens for users who are licensed for the Wildfire - their findings end up in signatures shared with everyone else. You are benefiting in the first step, but without license you are not participating in the rest of the flowchart.

So you are already having all the free benefits you can have provided that you are updating AV on a regular basis and of course if you are using AV profiles in the security policies.

Hope this clarifies your question.

Regards

Luciano

Re: Free wildfire

jdprovine — Mon, 31 Aug 2015 13:10:03 GMT

Wow the tone of this response is unbelievable.

Re: Free wildfire

VinceM — Mon, 31 Aug 2015 13:20:13 GMT

Hi,

If you want to test all Wildfire feature, you should have a test license (1 month) on your paloalto portal (where you registered your device).

hope help

Re: Free wildfire

jdprovine — Mon, 31 Aug 2015 14:29:42 GMT

TAC just showed me how to configure the limited version of wildfire

Re: Free wildfire

pulukas — Tue, 01 Sep 2015 00:03:14 GMT

Is the procedure documented somewhere for the limited version?

Re: Free wildfire

jdprovine — Thu, 03 Sep 2015 15:59:54 GMT

According to TAC you configure it the same way that you do the licensed version but you don't add the license. The catch is that there are only certain types of files that it will do and PE files are one of them

Re: Free wildfire

jdprovine — Tue, 08 Sep 2015 20:24:51 GMT

Trying to test my file block profile using this link

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Test-WildFire-with-a-Fake-Malicious-File/ta-p/60925.

I created a file blocking profile for PE files set to continue and forward. I went to the link and ran the fake file and nothing happened. There is nothing in the wildfire submission, data filtering or threat logs under the monitoring tab. Any suggestions?

Re: Free wildfire

OtakarKlier — Tue, 08 Sep 2015 22:27:35 GMT

Do you have ssl decryption enabled? I would try the non-ssl version of the test PE file.

wildfire.paloaltonetworks.com/publicapi/test/pe

I hope that is what you are asking about.

Re: Free wildfire

OtakarKlier — Tue, 08 Sep 2015 22:57:50 GMT

Hello Steve,

The 'limited' version is configured the same, you just dont perform the dynamic updates since you dont have the license. I hope that was what you were asking about.

Regards,

Re: Free wildfire

jdprovine — Wed, 09 Sep 2015 13:12:41 GMT

That is the link that I went too to test the wildfire but I was not given an option of non encrypted

Re: Free wildfire

jdprovine — Wed, 09 Sep 2015 13:13:35 GMT

Didn't you say you were using the limited version as well? Did you have to select the benign file setting?

Re: Free wildfire

reaper — Wed, 09 Sep 2015 13:41:46 GMT

The benign setting allows for more reporting as this will also generate logs for any files that were uploaded and diagnosed as benign, but is not a necessary setting to enable the unlicensed version of WildFire.

It may come in handy when setting up WildFire for the first time to generate reports sooner, as waiting around for a malicious file can take a while.

regards

Tom

Re: Free wildfire

jdprovine — Wed, 09 Sep 2015 14:27:46 GMT

I have it all configured and I opened the wildfire test file on a test pc and nothing is showing up in the PA wildfire submissions or data filtering logs so I don't know if its really working

Re: Free wildfire

reaper — Wed, 09 Sep 2015 15:00:20 GMT

Hi!

Did you make sure to enable ssl decryption, and is this reflected in the session details:

you may need to allow the management interface of your device access out to the internet or finetune any serviceroutes you have set to allow the management plane to upload files to the cloud

here's a couple of commands you can use to verify everything is functioning as expected:

show wildfire status
show wildfire statistics
show wildfire cloud-info

regards

Tom

Re: Free wildfire

jdprovine — Wed, 09 Sep 2015 15:28:04 GMT

Doesn't it require a license to do decryption? Here are the results of running the commands you suggested-

Show wildfire status

Connection info:
Wildfire cloud:                public cloud
Status:                        Idle
Best server:                   us-east-1.wildfire.paloaltonetworks.com
Device registered:             yes
Valid wildfire license:        no
Service route IP address:      136.176.190.223
Signature verification:        enable
Server selection:              enable
Through a proxy:               no

File size limit info:
pe                                           2 MB
apk                                         10 MB
pdf                                        200 KB
ms-office                                  500 KB
jar                                          1 MB
flash                                        5 MB

Forwarding info:
file idle time out (second):                          90
total file forwarded:                                  0
file forwarded in last minute:                         0
concurrent files:                                      0

show wildfire statistics

Packet based counters:

Total files received from DP: 0

Counters for file cancellation:

Counters for file forwarding:

file type: apk

file type: pdf

file type: email-link

file type: ms-office

file type: pe

file type: flash

file type: jar

file type: unknown

file type: pdns

Error counters:

Reset counters:
        DP receiver reset cnt:                     113
        File cache reset cnt:                        5
        Service connection reset cnt:                7
        Log cache reset cnt:                         1
        Report cache reset cnt:                      1

Resource meters:
        data_buf_meter                               0%
        msg_buf_meter                                0%
        ctrl_msg_buf_meter                           0%

File forwarding queues:
        priority: 1, size: 0
        priority: 2, size: 0
        priority: 3, size: 0

show wildfire cloud-info

Cloud info:
Cloud server type:             wildfire cloud
Supported file types:
                                 jar
                                 flash
                                 ms-office
                                 pe
                                 pdf
                                 apk
                                 email-link