Configure the VM Interface on the WildFire Appliance

1. Set the IP information for the VM interface on the WildFire appliance. The following IPv4 values are used in this example, but the appliance also supports IPv6 addresses:

   • IP address - 10.16.0.20/22
   • Subnet Mask - 255.255.252.0
   • Default Gateway - 10.16.0.1
   • DNS Server - 10.0.0.246

   The VM interface cannot be on the same network as the management interface (MGT).

   1. Enter configuration mode:

      admin@WF-500> configure

   2. Set the IP information for the VM interface:

      admin@WF-500# set
      deviceconfig system vm-interface ip-address 10.16.0.20 netmask 255.255.252.0
      default-gateway 10.16.0.1 dns-server 10.0.0.246

      You can only configure one DNS server on the VM interface. As a best practice, use the DNS server from your ISP or an open DNS service.
2. Enable the VM interface.

   1. Enable the VM interface:

      admin@WF-500# set
      deviceconfig setting wildfire vm-network-enable yes

   2. Commit the configuration:

      admin@WF-500# commit

3. Test connectivity of the VM interface.

   Ping a system and specify the VM interface as the source. For example, if the VM interface IP address is 10.16.0.20, run the following command where ip-or-hostname is the IP or hostname of a server/network that has ping enabled:

   admin@WF-500> ping
   source 10.16.0.20 host ip-or-hostname

   For example:

   admin@WF-500> ping
   source 10.16.0.20 host 10.16.0.1

4. (Optional) Send any malicious traffic that the malware generates to the Internet. The Tor network masks your public facing IP address, so the owners of the malicious site cannot determine the source of the traffic.

   1. Enable the Tor network:

      admin@WF-500# set
      deviceconfig setting wildfire vm-network-use-tor

   2. Commit the configuration:

      admin@WF-500# commit

5. (Optional) Verify that the Tor network connection is active and healthy.

   1. Issue the following CLI commands to search for Tor event IDs in the appliance logs. A properly configured and operational WildFire appliance should not generate any event IDs:

      • admin@WF-500(active-controller)>showlog system direction equal backward | match anonymous-network-unhealthy—The Tor service is down or otherwise non-operational. Consider restarting your Tor service and verify that it is operating properly.
      • admin@WF-500(active-controller)>show log systemdirection equal backward | match anonymous-network-unavailable—The Tor service is operating normally but the WildFire appliance VM interface is unable to establish a connection. Verify your network connections and settings and re-test.
6. Connect the Firewall to the WildFire Appliance VM Interface.