Wildfire

[Hammer88]

I was wondering ifsomeone could help with clarifying how the WildFire– Proof Point integration works.

A client of ours has Palo Alto NGFW in more geographically distant locations, and they also have Proof Point integrated with Wild Fire.

[1] How and with whom does Proof Point communicate and where is his position in the network?

[2] In regard to the Wild Fire licence, does it have to be on all of the Palo Alto NGFW active in order for Proof Point to work?

[3] Does Proof Point work regardless on which location the licence for WildFire is installed?

Thank you in advance,

[Remo]

Hi @Hammer88 

It depends on the proofpoint product that you have. Actually you need at least one firewall with a wildfire subscription as you need the wildfire API key. But depending on the protection you requires you need a wildfire subscription for more/all your firewalls ... this depends on your current topology and security requirements.

[Hammer88]

Hi @Remo ,

So would you say that the Proof Point , in general, would do the analysis only on the locations where the WildFire licence is active? Can it be done on Firewalls where there is no active WildFire licence?

[Remo · Accepted solution]

Hi @Hammer88 

There ia no direct integration betqwen something on the firewall and proofpoint. Actually I know only a little about proofpoint email gateway. There you need a wildfire API key. To get such a key you ned at least one active wildfire subscription. For this integration there is no communication between the firewall and proofpoint required as proofpoint uploads the attachments to wildfire. If wildfire sees this as malware a signature is created which the firewall downloada directly from paloalto update servers. 

[OtakarKlier · Accepted solution]

Hello,

Here are some replies to your questions:

1. if you setup Proofpoint with the Wildfire API, it would be Proofpoint that sends the request to the wildfire cloud, not your PAN's

2. No. however the PAN's that do not have the license will not get the new signatures as quickly as the ones that do have it. 5-10 minutes with a license, 1+day without license.

3. Yes, Proofpoint sends the requests to the Wildfire cloud via an API. It does not matter where the PAN with the license is located.

Hope that helps.

[Hammer88]

Thanks to all very much.

Regards,

[YazarArafath]

Dear Team,

I am Looking for Wildfire Initial Configuration for 500 Physical Appliance through cli. Please share if any body have.

Best Regards,

A.yazar