topic Wildfire Initial Configuration Cli in General Topics

Wildfire

Hammer88 — Sat, 11 May 2019 13:48:42 GMT

I was wondering ifsomeone could help with clarifying how the WildFire– Proof Point integration works.

A client of ours has Palo Alto NGFW in more geographically distant locations, and they also have Proof Point integrated with Wild Fire.

[1] How and with whom does Proof Point communicate and where is his position in the network?

[2] In regard to the Wild Fire licence, does it have to be on all of the Palo Alto NGFW active in order for Proof Point to work?

[3] Does Proof Point work regardless on which location the licence for WildFire is installed?

Thank you in advance,

Re: Wildfire

Remo — Sun, 12 May 2019 10:37:10 GMT

Hi @Hammer88

It depends on the proofpoint product that you have. Actually you need at least one firewall with a wildfire subscription as you need the wildfire API key. But depending on the protection you requires you need a wildfire subscription for more/all your firewalls ... this depends on your current topology and security requirements.

Re: Wildfire

Hammer88 — Mon, 13 May 2019 07:13:49 GMT

Hi @Remo ,

So would you say that the Proof Point , in general, would do the analysis only on the locations where the WildFire licence is active? Can it be done on Firewalls where there is no active WildFire licence?

Re: Wildfire

Remo — Mon, 13 May 2019 14:37:47 GMT

Hi @Hammer88

There ia no direct integration betqwen something on the firewall and proofpoint. Actually I know only a little about proofpoint email gateway. There you need a wildfire API key. To get such a key you ned at least one active wildfire subscription. For this integration there is no communication between the firewall and proofpoint required as proofpoint uploads the attachments to wildfire. If wildfire sees this as malware a signature is created which the firewall downloada directly from paloalto update servers.

Re: Wildfire

OtakarKlier — Mon, 13 May 2019 15:03:21 GMT

Hello,

Here are some replies to your questions:

1. if you setup Proofpoint with the Wildfire API, it would be Proofpoint that sends the request to the wildfire cloud, not your PAN's

2. No. however the PAN's that do not have the license will not get the new signatures as quickly as the ones that do have it. 5-10 minutes with a license, 1+day without license.

3. Yes, Proofpoint sends the requests to the Wildfire cloud via an API. It does not matter where the PAN with the license is located.

Hope that helps.

Re: Wildfire

Hammer88 — Mon, 20 May 2019 06:42:50 GMT

Thanks to all very much.

Regards,

Wildfire Initial Configuration Cli

YazarArafath — Sun, 07 Feb 2021 12:02:18 GMT

Dear Team,

I am Looking for Wildfire Initial Configuration for 500 Physical Appliance through cli. Please share if any body have.

Best Regards,

A.yazar