Wildfire reports refuse to connect

cancel
Showing results for 
Search instead for 
Did you mean: 

Wildfire reports refuse to connect

L0 Member

Hi Team, 

 

We are facing an error in wildfire reports after updagrade to 10.0.8h4 . it says wildfire reports refuse to connect.

 

Please suggest any solution  to check but if i updgrade to 10.1.3 it is working fine in mylab.

 

Regards

Chetan

11 REPLIES 11

L4 Transporter

Did you get any response from PA on this? For the first time ever, we got a hit in Wildfire for a file last night. But when trying to review the Wildfire report I am also getting a "refused to connect" error. Running version 9.1.12.

L4 Transporter

Digging thru the webcode, it appears to be something wrong in the javascript or firewall. The Wildfire Analysis Report tab tries to pull a file from:

hxxps://<firewall>/wf_report/private/wildfire.paloaltonetworks.com/443/xxx/panos/...

 

That then tries to redirect to:

hxxps://wildfire.paloaltonetworks.com/443/xxx/panos/report/9.0/<encoded string>

 

which fails with a file-not-found error. The URL is screwed up/not parsed correctly. Removing the "443/xxx/" you get the correct Wildfire report.

hxxps://wildfire.paloaltonetworks.com/panos/report/9.0/<encoded string>

 

I suspect the "xxx" is the failure point, something not parsed correctly in the javascript, which then fails to be interpreted in the firewall redirect.

I reproduced this issue in version 10.0.8-h4. After further searching, this is a known issue affecting version 10.0.8. As stated in the following KB, this issue was fixed in PAN-OS version 10.0.9.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004N9oCAE

L4 Transporter

Interesting, I can't even find that KB by searching the expected terms. The only relevant thing that comes up is this thread in the community forums. Looking at the 9.1 release notes I don't see anything about wildfire or iframe fixes either (though I don't see it in the 10.0.9 release notes either).

L4 Transporter

After opening a TAC case, this is apparently known issue PAN-183826 (doesn't show up in any Known Issues list). It also affects 9.1.x, in addition to 10.0, and is expected to be fixed in the 9.1.14 release.

L1 Bithead

I'm on 10.1.5 h2 and have same problem. 

L4 Transporter

9.1.13 was released a couple days ago. I haven't upgraded to it yet, but the release notes still don't show anything for PAN-183826, either fixed or known issue. Likewise, the 10.1 release notes don't have anything...

 

The ultimate problem is that the PA interface has security webcode to prevent opening iframes within the secure page. The Wildfire Analysis Report tab tries to show the Wildfire PDF report in an iframe... As a workaround you can extract the report URL from the iframe source code and open it in a new browser window.

L1 Bithead

I notice the same issue when going to help page from any ? icon, the left pane where the menu is, shows same behavior, "refused to connect" I've opened a TAC case.  Restarting the management service did not resolve the issue.

L0 Member

I heard from TAC that PaloAlto will soon update the PAN-OS 9.1.14 release notes to include PAN-183826.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!