Enable Free WildFire Forwarding

Confirm that your firewall is registered and that you have a valid support account as well as any subscriptions you require.
Log in to the Palo Alto Networks Customer Support Portal(CSP) and on the left-hand side navigation pane, select
Assets
Devices
.
Verify that the firewall is listed. If it is not listed, select
Register New Device
and continue to Register the Firewall.
(
Optional
) If you have a Threat Prevention subscription, be sure to Activate Subscription Licenses.
Log in to the firewall and configure WildFire forwarding settings.
Select
Device
Setup
WildFire
and edit the General Settings.
Set the
WildFire Public Cloud
field to forward files to the WildFire global cloud at:
wildfire.paloaltonetworks.com
.
You can also forward files to a regional cloud or a private cloud based on your location and your organizational requirements.
Review the
File Size Limits
for PEs the firewall forwards for WildFire analysis. set the
Size Limit
for PEs that the firewall can forward to the maximum available limit of 10 MB.
As a WildFire best practice, set the
Size Limit
for PEs to the maximum available limit of 10 MB.
Click
OK
to save your changes.
Enable the firewall to forward PEs for analysis.
Select
Objects
Security Profiles
WildFire Analysis
and
Add
a new profile rule.
Name
the new profile rule.
Add
a forwarding rule and enter a
Name
for it.
In the
File Types
column, add
pe
files to the forwarding rule.
In the
Analysis
column, select
public-cloud
to forward PEs to the WildFire public cloud.
Click
OK
.
Apply the new WildFire Analysis profile to traffic that the firewall allows.
Select
Policies
Security
and either select an existing policy rule or create a new policy rule as described in Set Up a Basic Security Policy.
Select
Actions
and in the Profile Settings section, set the
Profile Type
to
Profiles
.
Select the
WildFire Analysis
profile you just created to apply that profile rule to all traffic this policy rule allows.
Click
OK
.
Enable the firewall to forward decrypted SSL traffic for WildFire analysis.
Review and implement WildFire best practices to ensure that you are getting the most of WildFire detection and prevention capabilities.
Commit
your configuration updates.
Verify that the firewall is forwarding PE files to the WildFire public cloud.
Select
Monitor
Logs
WildFire Submissions
to view log entries for PEs the firewall successfully submitted for WildFire analysis. The Verdict column displays whether WildFire found the PE to be malicious, grayware, or benign. (WildFire only assigns the phishing verdict to email links). The Action column indicates whether the firewall allowed or blocked the sample. The Severity column indicates how much of a threat a sample poses to an organization using the following values: critical, high, medium, low, information.
(
Threat Prevention subscription only
) If you have a Threat Prevention subscription, but do not have a WildFire subscription, you can still receive WildFire signature updates every 24- 48 hours.
Select
Device
Dynamic Updates
.
Check that the firewall is scheduled to download, and install Antivirus updates.