The virtual machine interface (vm-interface) provides external network connectivity from the sandbox virtual machines in the WildFire appliance to enable observation of malicious behaviors in which the file being analyzed seeks network access. The following sections describe the VM interface and the steps required for configuring it. You can optionally enable the Tor feature with the VM interface, which will mask any malicious traffic sent from the WildFire appliance through the VM interface, so the malware sites that the traffic may be sent to cannot detect your public‑facing IP address.

This section also describes the steps required to connect the VM interface to a dedicated port on a Palo Alto Networks firewall to enable Internet connectivity.