how to configure wildfire to block a malicious file?

[thanachaip]

i used PA3020 and software version 6.0.0, wildfire version is 26818-33137

i configured wildfire action to block in antivirus profile and apply to security policy already.

but, when i test to download a malicious files. the action is alert and i can download this file. why?

i don't know, what is wrong in my configure and i want to know, how to configure wildfire to block a malicious file.

[VinceM]

Hi,

What about the wildfire report for your virus.exe file ?

V.

[Mystique]

Do you have a configured file blocking profile ? What is the action set for the file blocking profile under objects ?

[thanachaip]

Hi,VinceM

this's wildfire analysis report.

[thanachaip]

@hparikh

i configured action in blocking profile to "forward".

[Mystique]

Wildfire report shows that the first time the malware was reported at 02-24 14:08 and the log shows alert for type wildfire at 22:59 with wildfire-upload-skip since the file has been already sent to wildfire cloud

If the firewall is equipped with a WildFire subscription then it can receive the new signatures within 30-60 minutes; firewalls with only a Threat Prevention subscription can receive the new signatures in the next antivirus signature update within 24-48 hours. Can you please confirm if you have valid license for wildfire? The wildfire version that you have is 26818-33137 and the latest available is 26836-33168.

[thanachaip]

i try to test this virus.exe about 4 hours. and i download an update already.

and if you look at this pic. wildfire log is show "virus.exe" is malicious but action is alert, not block.

[mg_imid]

Hi thanachaip,

Nothing false in your configuration.

I got the same problem and already open case for it.

[HULK]

Could you please share the case ID here.

[mg_imid]

Hi HULK,

My case number : 00189573.