Enable Hold Mode for Real-Time Signature Lookup

To enable hold mode for WildFire real-time signature lookups, you must have either a WildFire or Advanced WildFire subscription service license. Make sure to activate the license on the firewall if you have not done so already. To verify subscriptions for which you have currently-active licenses, select

Device

Licenses

and verify that the appropriate licenses display and are not expired. The example below shows the description for the standard WildFire license.

Set the schedule for the firewall to retrieve WildFire signatures in real-time.

Even when the firewall is configured to use real-time signatures, supplemental signature packages are still installed on a regular basis. This provides an up-to-date signature source when you experience connectivity issues, as well as a speed benefit, where signatures are available locally.

Select
Device
Dynamic Updates
.
Select the
Schedule
for WildFire updates.
Set the
Recurrence
(how often the firewall checks the Palo Alto Networks update server for new signatures) for
Real-time
updates.
Click
OK
to save the WildFire update schedule and then
Commit
your changes.

Configure the timeout setting and action when the request exceeds the timeout.

You must enable hold mode globally before you enable hold mode for WildFire real-time signature lookups on a per-Antivirus profile basis.

Select
Device Setup
ContentID
Realtime Signature Lookup
Enable
Hold for WildFire Real Time Signature Look Up
.
Specify the
WildFire Real Time Signature Lookup Timeout (ms)
in milliseconds (the default value is 1000).
Palo Alto Networks recommends using the default value of 1000ms unless you experience repeated timeouts during testing.
Specify the
Action On Real Time WildFire Signature Timeout
. The default value is
Allow
, however, Palo Alto Networks recommends setting this to
Reset-Both
when hold mode is enabled. The options include the following:
Allow—The NGFW allows packets through when the hold timeout threshold is reached.
Reset Both—The NGFW resets the connection on both the client and server ends when the hold timeout threshold is reached.
Select
OK
when finished.

Update or create a new Antivirus Security profile to enable hold mode for WildFire real-time signature lookups.

Select an existing antivirus security profile or
Add
a new one (
Objects
Security Profiles
Antivirus
).
Select your antivirus security profile and then go to
Action
.
Select
Hold for WildFire Real Time Signature Look Up
.
Repeat steps 4.1-4.3 for all active antivirus profiles for which you want to enable hold mode for WildFire real-time signature lookups.

Commit

your changes.

(Optional) You can view a summary of your antivirus security profile settings, including hold mode enablement, on the antivirus summary view page.