Forward Files for Advanced WildFire Analysis (PAN-OS & Panorama)

1. (PA-7000 Series Firewalls Only) To enable a PA-7000 Series firewall to forward samples for analysis, you must first configure a data port on an NPC as a Log Card interface. If you have a PA-7000 series appliance equipped with an LFC (log forwarding card), you must configure a port used by the LFC. When configured, the log card port or the LFC interface takes precedence over the management port when forwarding samples.
2. Specify the Advanced WildFire Deployments to which you want to forward samples.

   Select DeviceSetupWildFire and edit the General Settings based on your WildFire cloud deployment (public, government, private, or hybrid).

   The WildFire U.S. Government Cloud is only available to U.S. Federal agencies as an optional analysis environment.

   Advanced WildFire Public Cloud:

   1. Enter the WildFire Public Cloud URL:

      • United States: wildfire.paloaltonetworks.com
      • Europe: eu.wildfire.paloaltonetworks.com
      • Japan: jp.wildfire.paloaltonetworks.com
      • Singapore: sg.wildfire.paloaltonetworks.com
      • United Kingdom: uk.wildfire.paloaltonetworks.com
      • Canada: ca.wildfire.paloaltonetworks.com
      • Australia: au.wildfire.paloaltonetworks.com
      • Germany: de.wildfire.paloaltonetworks.com
      • India: in.wildfire.paloaltonetworks.com
      • Switzerland: ch.wildfire.paloaltonetworks.com
      • Poland: pl.wildfire.paloaltonetworks.com
      • Indonesia: id.wildfire.paloaltonetworks.com
      • Taiwan: tw.wildfire.paloaltonetworks.com
      • France: fr.wildfire.paloaltonetworks.com
      • Qatar: qatar.wildfire.paloaltonetworks.com
      • South Korea: kr.wildfire.paloaltonetworks.com
      • South Africa: za.wildfire.paloaltonetworks.com
      • Israel: il.wildfire.paloaltonetworks.com
      • Saudi Arabia: sa.wildfire.paloaltonetworks.com
      • Italy: it.wildfire.paloaltonetworks.com
      • Spain: es.wildfire.paloaltonetworks.com
      • Brazil: br.wildfire.paloaltonetworks.com
   2. Make sure the WildFire Private Cloud field is clear.

   WildFire FedRAMP Cloud options:

   1. Enter the WildFire FedRAMP Cloud URL:

      • U.S. Government Cloud: wildfire.gov.paloaltonetworks.com
      • Advanced WildFire Government Cloud: gov-cloud.wildfire.paloaltonetworks.com
      • Advanced WildFire Public Sector Cloud: pubsec-cloud.wildfire.paloaltonetworks.com
   2. Make sure the WildFire Private Cloud field is clear.
3. Define the size limits for files the firewall forwards and configure logging and reporting settings.

   Continue editing General Settings (DeviceSetupWildFire).

   • Review the File Size Limits for files forwarded from the firewall.
     It is a Advanced WildFire Best Practices to set the File Size for PEs to the maximum size limit of 10 MB, and to leave the File Size for all other file types set to the default value.
   • Select Report Benign Files to allow logging for files that receive a verdict of benign.
   • Select Report Grayware Files to allow logging for files that receive a verdict of grayware.
   • Define what session information is recorded in WildFire analysis reports by editing the Session Information Settings. By default, all session information is displayed in WildFire analysis reports. Clear the check boxes to remove the corresponding fields from WildFire analysis reports and click OK to save the settings.
4. Define traffic to forward for analysis.

   1. Select ObjectsSecurity ProfilesWildFire Analysis, Add a new WildFire analysis profile, and give the profile a descriptive Name.
   2. Add a profile rule to define traffic to be forwarded for analysis and give the rule a descriptive Name, such as local-PDF-analysis.
   3. Define the profile rule to match to unknown traffic and to forward samples for analysis based on:

      • Applications—Forward files for analysis based on the application in use.
      • File Types—Forward files for analysis based on file types, including links contained in email messages. For example, select PDF to forward unknown PDFs detected by the firewall for analysis.
      • Direction—Forward files for analysis based the transmission direction of the file (upload, download, or both). For example, select both to forward all unknown PDFs for analysis, regardless of the transmission direction.
   4. Click OK to save the WildFire analysis profile.
5. Attach the WildFire Analysis profile to a security policy rule.

   Traffic allowed by the security policy rule is evaluated against the attached WildFire analysis profile; the firewalls forwards traffic matched to the profile for WildFire analysis.

   1. Select PoliciesSecurity and Add or modify a policy rule.
   2. Click the Actions tab within the policy rule.
   3. In the Profile Settings section, select Profiles as the Profile Type and select a WildFire Analysis profile to attach to the policy rule

6. Make sure to enable the firewall to also Forward Decrypted SSL Traffic for Advanced WildFire Analysis.

   This is a recommended best practice.
7. (Optional) Enable Advanced WildFire Inline ML
8. (Optional) Enable Hold Mode for Real-Time Signature Lookup
9. Review and implement Advanced WildFire Best Practices.
10. Click Commit to apply the updated settings.
11. (Optional) Install a Device Certificate to update to the latest version of the certificate used by the firewall to communicate with Palo Alto Networks cloud services.
12. (Optional) Configure the Content Cloud FQDN Settings.
13. Choose what to do next...

    • Verify WildFire Submissions to confirm that the firewall is successfully forwarding files for analysis.
    • Monitor WildFire Activity to assess alerts and details reported for malware.