Wildfire Double Ring - Perimetral Network External / Internal

[SOC_CSG]

Hello, :smileyinfo:

We have a double ring structure and we are trying to implement the most appropriate settings for the Wildfire, according to the scenario that we have.

-A Cluster 2 firewalls External *OUT*

  Model PA-500

  WildFire Version 52587-59292 (02/02/15)

-A Cluster 2 firewalls Internal *IN

  Model PA-2050

  WildFire Version 52588-59293 (02/03/15)

Logs -> Wildfire Submissions

Why we don't see anything in Wildfire Submissions?

What settings can you recommand me?

To perform an analysis. How could we do this?

• A monthly report by wildfire scanned files with malware verdict.
• A monthly report with the Top of machines that are connected to dangerous sites.
• A monthly report with the Top dangerous sites.
• A monthly report with the machines that are trying to download files and analyzed with malware verdict.

Regards,

Diego C.

[HULK]

Hello Diego,

You may follow this doc to understand different settings for wildfire: How to Configure WildFire

FYI..

How to Generate a Custom Report for Wildfire Logs

Thanks

[HULK · Accepted solution]

Hello Diego,

Could you please check what action has been set on your file-blocking profile, it should be "forward" or "continue-and-forward" to send the file to wildfire cloud for analysis.

forward—The file is automatically sent to WildFire.

–

continue-and-forward—A continue page is presented, and the file is sent to WildFire (combines the continue and forward actions). This action only works with web-based traffic. This is due to the fact that a user must click continue before the file will be forward and the continue response page option is only available with http/https.

Thanks