1. Home
    2. PAN-OS
    3. PAN-OS® Administrator’s Guide
    4. Getting Started
    5. Enable Free WildFire Forwarding

    Enable Free WildFire Forwarding

    WildFire is a cloud-based virtual environment that analyzes and executes unknown samples (files and email links) and determines the samples to be malicious, phishing, grayware, or benign. With WildFire enabled, a Palo Alto Networks firewall can forward unknown samples to WildFire for analysis. For newly-discovered malware, WildFire generates a signature to detect the malware and distributes it to all firewalls with active WildFire subscription within minutes. This enables all Palo Alto next-generation firewalls worldwide to detect and prevent malware found by a single firewall. Malware signatures often match multiple variants of the same malware family, and as such, block new malware variants that the firewall has never seen before. The Palo Alto Networks threat research team uses the threat intelligence gathered from malware variants to block malicious IP addresses, domains, and URLs.
    A basic WildFire service is included as part of the Palo Alto Networks next-generation firewall and does not require a WildFire subscription. With the basic WildFire service, you can enable the firewall to forward portable executable (PE) files. Additionally, if you do not have a WildFire subscription, but you do have a Threat Prevention subscription, you can receive signatures for malware WildFire identifies every 24- 48 hours (as part of the Antivirus updates).
    Beyond the basic WildFire service, a WildFire subscription is required for the firewall to:
    • Get the latest WildFire signatures within a minute of availability—new signatures are released every five minutes.
    • Forward advanced file types and email links for analysis.
    • Use the WildFire API.
    • Use a WildFire appliance to host a WildFire private cloud or a WildFire hybrid cloud.
    If you have a WildFire subscription, go ahead and get started with WildFire to get the most out of your subscription. Otherwise, take the following steps to enable basic WildFire forwarding:
    1. Confirm that your firewall is registered and that you have a valid support account as well as any subscriptions you require.
      1. Log in to the Palo Alto Networks Customer Support Portal(CSP) and on the left-hand side navigation pane, select
        Assets
        Devices
        .
      2. Verify that the firewall is listed. If it is not listed, select
        Register New Device
         and continue to Register the Firewall.
      3. (
        Optional
        ) If you have a Threat Prevention subscription, be sure to Activate Subscription Licenses.
    2. Log in to the firewall and configure WildFire forwarding settings.
      1. Select
        Device
        Setup
        WildFire
         and edit the General Settings.
      2. Set the
        WildFire Public Cloud
         field to forward files to the WildFire global cloud at:
        wildfire.paloaltonetworks.com
        .
        You can also forward files to a regional cloud or a private cloud based on your location and your organizational requirements.
      3. Review the
        File Size Limits
         for PEs the firewall forwards for WildFire analysis. set the
        Size Limit
         for PEs that the firewall can forward to the maximum available limit of 10 MB.
        As a WildFire best practice, set the
        Size Limit
         for PEs to the maximum available limit of 10 MB.
      4. Click
        OK
         to save your changes.
    3. Enable the firewall to forward PEs for analysis.
      1. Select
        Objects
        Security Profiles
        WildFire Analysis
         and
        Add
         a new profile rule.
      2. Name
         the new profile rule.
      3. Add
         a forwarding rule and enter a
        Name
         for it.
      4. In the
        File Types
         column, add
        pe
         files to the forwarding rule.
      5. In the
        Analysis
         column, select
        public-cloud
         to forward PEs to the WildFire public cloud.
      6. Click
        OK
        .
    4. Apply the new WildFire Analysis profile to traffic that the firewall allows.
      1. Select
        Policies
        Security
         and either select an existing policy rule or create a new policy rule as described in Set Up a Basic Security Policy.
      2. Select
        Actions
         and in the Profile Settings section, set the
        Profile Type
         to
        Profiles
        .
      3. Select the
        WildFire Analysis
         profile you just created to apply that profile rule to all traffic this policy rule allows.
      4. Click
        OK
        .
    5. Enable the firewall to forward decrypted SSL traffic for WildFire analysis.
    6. Review and implement WildFire best practices to ensure that you are getting the most of WildFire detection and prevention capabilities.
    7. Commit
       your configuration updates.
    8. Verify that the firewall is forwarding PE files to the WildFire public cloud.
      Select
      Monitor
      Logs
      WildFire Submissions
       to view log entries for PEs the firewall successfully submitted for WildFire analysis. The Verdict column displays whether WildFire found the PE to be malicious, grayware, or benign. (WildFire only assigns the phishing verdict to email links). The Action column indicates whether the firewall allowed or blocked the sample. The Severity column indicates how much of a threat a sample poses to an organization using the following values: critical, high, medium, low, information.
    9. (
      Threat Prevention subscription only
      ) If you have a Threat Prevention subscription, but do not have a WildFire subscription, you can still receive WildFire signature updates every 24- 48 hours.
      1. Select
        Device
        Dynamic Updates
        .
      2. Check that the firewall is scheduled to download, and install Antivirus updates.

    Related Documentation

    © 2019 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo