Free wildfire

Showing results for 
Search instead for 
Did you mean: 

Free wildfire

L4 Transporter

I thought there was a limited version of wildfire that you could use for PE files. But it isn't working, I do a test registration and it fails. Is there something that is missing in the instruction that I have


SSL decrypt does not require a license.


can you post your FileBlocking profile config and show where's applied to the security policy?

Then, as others have request, show us the traffic monitor for the file download session in question.


This type of configuration is something we do on a regular basis for hungreds of clients.





I looked at the statistics throught the CLI while running the test and got this


error counters


Number of times an attempt to establish an SSL tunnel between the device and the WildFire cloud has failed.  A connection is either immediately retried or attempted at a 1 minute interval, depending on the function being performed.



Is the contral plane apble to communicate to the WF cloud, do you have a rule or service route that lets the approprite App-ID off of your network?


Easy way to check is the enable logging on Interzone rule and see if the traffic is being dropped.

Hi jprovine


you'll want to have a security policy that allows ssl and paloalto-wildfire-cloud out to the internet from the management interface without security profiles (or you might recapture that same executable)



Tom Piens

@ethiSEC and @reaperPANgurus are both correct but in my opinion issues arise sooner in the workflow. If there was just a rule missing we would still be able to see "Forward" action in the Data Filtering log. According to @jdprovine Data filtering log is empty.


Can you try this in the CLI:


test security-policy-match from srcZone to dstZone source srcIP destination dstIP protocol 6 destination-port 80

Enter the srcZone, dstZone, srcIP and dstIP for the session in which you download the test file.


Output will be the security rule that was used for accessing the test file. Then make sure the File Blocking profile you pasted earlier is applied to that rule.

That is the first time anyone has mentioned the need for a security policy to allow access to the wildfire in the cloud. So how was it able to register?


Test wildfire

        Testing cloud server ...
        wildfire registration:         successful
        download server list:          successful
        select the best server:

TAC remoted in and identified updated the destination zone in order to allow it access to the internet. So my next question is can you only put it on security policies that have access to the outside/untrust/internet zone?

You should be able to apply it to any security policy, I have it setup this way so it scans between my VPN users zone and my 'trust' zone. Only the management interface, or the interface as defined by your services used for the PAN to communicate with the wildfire cloud, need to be allowed to the untrusted (internet) zone.


Hope this makes sense.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!