WF

[tinhnho]

Hi guys,

Besides Monitor - Logs - Wildfire Submissions, where else must we check whether Wildfire is working?

Thanks All.

[TomYoung]

Hi @tinhnho ,

Great question.  The PANW best practice is to "attach security profiles to all Security policy rules that allow traffic."  This includes the WildFire security profile.  See 1st paragraph -> https://docs.paloaltonetworks.com/best-practices/9-1/internet-gateway-best-practices/best-practice-i....

I use security profile groups so that I can make changes in the group rather than having to change every allow rule.

Thanks,

Tom

[TomYoung]

Hi @tinhnho ,

If the device is getting automatic updates and it is not configured in the template, then it is configured locally or pushed from Panorama.  What is configured under Device > Dynamic Updates on the NGFW?  What is configured under Panorama > Device Deployment > Dynamic Updates?

Thanks,

Tom

[TomYoung]

Hi @tinhnho ,

I'm sorry.  I should have said Panorama > Device Deployment > Dynamic Updates > Schedules.  Could you check that?  Once we get that answer, then I can answer the other questions.

Thanks,

Tom

[TomYoung · Accepted solution]

Hi @tinhnho ,

There it is!  Panorama is downloading WildFire updates every 30 minutes ( Panaroma > Dynamic Updates ) and pushing it out to the NGFWs every 30 minutes ( Panorama > Device Deployment > Dynamic Updates > Schedules ).  You can change the time interval in both places to change the schedule.

With regard to "How do we tell?", there should be logs somewhere, but I don't know off the top of my head.

Thanks,

Tom