Detections
Analytics

5.4 Ensure forwarding of decrypted content to WildFire is enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Allow the firewall to forward decrypted content to WildFire. Note that SSL Forward-Proxy must also be enabled and configured for this setting to take effect on inside-to-outside traffic flows.

Rationale:

As encrypted Internet traffic continues to proliferate, WildFire becomes less effective unless it is allowed to act on decrypted content. For example, if a user downloads a malicious pdf over SSL, WildFire can only provide analysis if 1) the session is decrypted by the firewall and 2) forwarding of decrypted content is enabled. In today's internet, roughly 70-80% of all user traffic is encrypted. If Wildfire is not configured to analyze encrypted content, the effectiveness of Wildfire is drastically reduced.

Solution

Navigate to Device > Setup > Content-ID > Content-ID Settings.
Set Allow forwarding of decrypted content to be checked.
Note that SSL Forward Proxy must be configured for this setting to be effective.

Default Value:

Not Configured

See Also

https://workbench.cisecurity.org/files/3750

Item Details

References: CSCv7|8, CSCv7|12.9, CSCv7|12.10

Plugin: Palo_Alto

Control ID: 16d48f51d86e8a5c2da66d108542bb3bc76d0e55400a68bd6ae0582c247d2897