All communication between a WF-500 WildFire appliance and a Palo Alto Networks firewall is handled by the firewall. The WF-500 listens for requests and sends requested data to the firewall. When a Palo Alto Networks firewall sends files to the WF-500 for analysis, the firewall periodically checks the WF-500 for the status of the scan. When the file results are available, the firewall will be provided with the results the next time it requests status.
Here are some of the ports and direction the traffic heads in.