Wildfire reports refuse to connect

[ChetanR]

Hi Team, 

We are facing an error in wildfire reports after updagrade to 10.0.8h4 . it says wildfire reports refuse to connect.

Please suggest any solution  to check but if i updgrade to 10.1.3 it is working fine in mylab.

Regards

Chetan

[Adrian_Jensen]

Did you get any response from PA on this? For the first time ever, we got a hit in Wildfire for a file last night. But when trying to review the Wildfire report I am also getting a "refused to connect" error. Running version 9.1.12.

[Adrian_Jensen]

Digging thru the webcode, it appears to be something wrong in the javascript or firewall. The Wildfire Analysis Report tab tries to pull a file from:

hxxps://<firewall>/wf_report/private/wildfire.paloaltonetworks.com/443/xxx/panos/...

That then tries to redirect to:

hxxps://wildfire.paloaltonetworks.com/443/xxx/panos/report/9.0/<encoded string>

which fails with a file-not-found error. The URL is screwed up/not parsed correctly. Removing the "443/xxx/" you get the correct Wildfire report.

hxxps://wildfire.paloaltonetworks.com/panos/report/9.0/<encoded string>

I suspect the "xxx" is the failure point, something not parsed correctly in the javascript, which then fails to be interpreted in the firewall redirect.

[ChetanR]

I reproduced this issue in version 10.0.8-h4. After further searching, this is a known issue affecting version 10.0.8. As stated in the following KB, this issue was fixed in PAN-OS version 10.0.9.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004N9oCAE

[Adrian_Jensen]

Interesting, I can't even find that KB by searching the expected terms. The only relevant thing that comes up is this thread in the community forums. Looking at the 9.1 release notes I don't see anything about wildfire or iframe fixes either (though I don't see it in the 10.0.9 release notes either).

[Adrian_Jensen]

After opening a TAC case, this is apparently known issue PAN-183826 (doesn't show up in any Known Issues list). It also affects 9.1.x, in addition to 10.0, and is expected to be fixed in the 9.1.14 release.

[RingoCheung]

I'm on 10.1.5 h2 and have same problem. 

[Adrian_Jensen]

9.1.13 was released a couple days ago. I haven't upgraded to it yet, but the release notes still don't show anything for PAN-183826, either fixed or known issue. Likewise, the 10.1 release notes don't have anything...

The ultimate problem is that the PA interface has security webcode to prevent opening iframes within the secure page. The Wildfire Analysis Report tab tries to show the Wildfire PDF report in an iframe... As a workaround you can extract the report URL from the iframe source code and open it in a new browser window.

[RingoCheung]

I notice the same issue when going to help page from any ? icon, the left pane where the menu is, shows same behavior, "refused to connect" I've opened a TAC case.  Restarting the management service did not resolve the issue.

[ookawa]

I heard from TAC that PaloAlto will soon update the PAN-OS 9.1.14 release notes to include PAN-183826.

[RingoCheung]

Worked with TAC on 10.1.5 h2 the workaround provided below (using Chrome): 
--> Navigated to Monitor->WildfireSubmissions->WildfireAnalysis Report
--> Right-click on it and select view frame source.
--> Remove the view-source from the URL
>> After completing the above workaround, we would be able to generate the report.

[ymiyashita]

PAN-183826 was added to PAN-OS 9.1.14 release note.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-release-notes/pan-os-9-1-addressed-issues/pan-os...
PAN-183826 - "Fixed an issue where, after clicking WildFire Analysis Report, the web interface failed to display the report with the following error message: refused to connect."