SSL decrypt does not require a license.
can you post your FileBlocking profile config and show where's applied to the security policy?
Then, as others have request, show us the traffic monitor for the file download session in question.
This type of configuration is something we do on a regular basis for hungreds of clients.
I looked at the statistics throught the CLI while running the test and got this
Number of times an attempt to establish an SSL tunnel between the device and the WildFire cloud has failed. A connection is either immediately retried or attempted at a 1 minute interval, depending on the function being performed.
Is the contral plane apble to communicate to the WF cloud, do you have a rule or service route that lets the approprite App-ID off of your network?
Easy way to check is the enable logging on Interzone rule and see if the traffic is being dropped.
you'll want to have a security policy that allows ssl and paloalto-wildfire-cloud out to the internet from the management interface without security profiles (or you might recapture that same executable)
@EthiSEC and @reaper are both correct but in my opinion issues arise sooner in the workflow. If there was just a rule missing we would still be able to see "Forward" action in the Data Filtering log. According to @jdprovine Data filtering log is empty.
Can you try this in the CLI:
test security-policy-match from srcZone to dstZone source srcIP destination dstIP protocol 6 destination-port 80
Enter the srcZone, dstZone, srcIP and dstIP for the session in which you download the test file.
Output will be the security rule that was used for accessing the test file. Then make sure the File Blocking profile you pasted earlier is applied to that rule.
That is the first time anyone has mentioned the need for a security policy to allow access to the wildfire in the cloud. So how was it able to register?
Testing cloud server ca-s1.wildfire.paloaltonetworks.com ...
wildfire registration: successful
download server list: successful
select the best server: us-west-1.wildfire.paloaltonetworks.com
TAC remoted in and identified updated the destination zone in order to allow it access to the internet. So my next question is can you only put it on security policies that have access to the outside/untrust/internet zone?
You should be able to apply it to any security policy, I have it setup this way so it scans between my VPN users zone and my 'trust' zone. Only the management interface, or the interface as defined by your services used for the PAN to communicate with the wildfire cloud, need to be allowed to the untrusted (internet) zone.
Hope this makes sense.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!