I thought there was a limited version of wildfire that you could use for PE files. But it isn't working, I do a test registration and it fails. Is there something that is missing in the instruction that I have
SSL decrypt does not require a license.
can you post your FileBlocking profile config and show where's applied to the security policy?
Then, as others have request, show us the traffic monitor for the file download session in question.
This type of configuration is something we do on a regular basis for hungreds of clients.
I looked at the statistics throught the CLI while running the test and got this
Number of times an attempt to establish an SSL tunnel between the device and the WildFire cloud has failed. A connection is either immediately retried or attempted at a 1 minute interval, depending on the function being performed.
@ethiSEC and @PANgurus are both correct but in my opinion issues arise sooner in the workflow. If there was just a rule missing we would still be able to see "Forward" action in the Data Filtering log. According to @jdprovine Data filtering log is empty.
Can you try this in the CLI:
test security-policy-match from srcZone to dstZone source srcIP destination dstIP protocol 6 destination-port 80
Enter the srcZone, dstZone, srcIP and dstIP for the session in which you download the test file.
Output will be the security rule that was used for accessing the test file. Then make sure the File Blocking profile you pasted earlier is applied to that rule.
That is the first time anyone has mentioned the need for a security policy to allow access to the wildfire in the cloud. So how was it able to register?
Testing cloud server ca-s1.wildfire.paloaltonetworks.com ...
wildfire registration: successful
download server list: successful
select the best server: us-west-1.wildfire.paloaltonetworks.com
You should be able to apply it to any security policy, I have it setup this way so it scans between my VPN users zone and my 'trust' zone. Only the management interface, or the interface as defined by your services used for the PAN to communicate with the wildfire cloud, need to be allowed to the untrusted (internet) zone.
Hope this makes sense.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!