Free wildfire

Reply
Highlighted
L2 Linker

Re: Free wildfire

SSL decrypt does not require a license.

 

can you post your FileBlocking profile config and show where's applied to the security policy?

Then, as others have request, show us the traffic monitor for the file download session in question.

 

This type of configuration is something we do on a regular basis for hungreds of clients.

 

c

Highlighted
L4 Transporter

Re: Free wildfire

fileblck.PNG

Highlighted
L4 Transporter

Re: Free wildfire

secpol.PNG

Highlighted
L4 Transporter

Re: Free wildfire

I looked at the statistics throught the CLI while running the test and got this

 

error counters
FWD_ERR_CONN_FAIL

 

Number of times an attempt to establish an SSL tunnel between the device and the WildFire cloud has failed.  A connection is either immediately retried or attempted at a 1 minute interval, depending on the function being performed.

 

 

Highlighted
L2 Linker

Re: Free wildfire

Is the contral plane apble to communicate to the WF cloud, do you have a rule or service route that lets the approprite App-ID off of your network?

 

Easy way to check is the enable logging on Interzone rule and see if the traffic is being dropped.

Highlighted
L7 Applicator

Re: Free wildfire

Hi jprovine

 

you'll want to have a security policy that allows ssl and paloalto-wildfire-cloud out to the internet from the management interface without security profiles (or you might recapture that same executable)

 

2015-09-14_10-07-11.png

reaper - PANgurus.com
I drink and I know things
Highlighted
L2 Linker

Re: Free wildfire

@EthiSEC and @reaper are both correct but in my opinion issues arise sooner in the workflow. If there was just a rule missing we would still be able to see "Forward" action in the Data Filtering log. According to @jdprovine Data filtering log is empty.

 

Can you try this in the CLI:

 

test security-policy-match from srcZone to dstZone source srcIP destination dstIP protocol 6 destination-port 80

Enter the srcZone, dstZone, srcIP and dstIP for the session in which you download the test file.

 

Output will be the security rule that was used for accessing the test file. Then make sure the File Blocking profile you pasted earlier is applied to that rule.

Highlighted
L4 Transporter

Re: Free wildfire

That is the first time anyone has mentioned the need for a security policy to allow access to the wildfire in the cloud. So how was it able to register?

 

Test wildfire

        Testing cloud server ca-s1.wildfire.paloaltonetworks.com ...
        wildfire registration:         successful
        download server list:          successful
        select the best server:        us-west-1.wildfire.paloaltonetworks.com

Highlighted
L4 Transporter

Re: Free wildfire

TAC remoted in and identified updated the destination zone in order to allow it access to the internet. So my next question is can you only put it on security policies that have access to the outside/untrust/internet zone?

Highlighted
L7 Applicator

Re: Free wildfire

You should be able to apply it to any security policy, I have it setup this way so it scans between my VPN users zone and my 'trust' zone. Only the management interface, or the interface as defined by your services used for the PAN to communicate with the wildfire cloud, need to be allowed to the untrusted (internet) zone.

 

Hope this makes sense.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!