topic Re: Log Forwarding to Panorama in Expedition Discussions

Log Forwarding to Panorama

MGRashmi — Tue, 29 Jan 2019 06:57:38 GMT

Hi,

I am using expedition tool to migrate the configuration from Cisco FWSM to Panorama. While reading the documents for "Log forwarding to Panorama", i understand that we need to select a security rule and set the log forwarding profile in order to receive the logs in Panorama. I have thousands of security rules which are being migrated and hence assigning forwarding profiles to individual security rules will consume a lot of time. Is there a way in which we can assign a log forwarding profile of an entire policy set to Panorama?

Re: Log Forwarding to Panorama

sjanita — Tue, 29 Jan 2019 21:06:45 GMT

You can follow these steps to apply changes to multiple policies - including adding a log forwarding profile.

1) if not already present you must create a LogForward profile: OBJECTS --> OTHER --> LogForward

you can use the snippet below to create a profile

<match-list>

<log-type>traffic</log-type>

<send-to-panorama>yes</send-to-panorama>

</entry>

</match-list>

</entry>

2) use the multi-edit option for the policies to select the policies you want to apply the log fowarding profile to

Re: Log Forwarding to Panorama

MGRashmi — Wed, 30 Jan 2019 06:06:12 GMT

Hi,

Thanks a lot for your response. If i use the multi-edit option, is there a way to apply the log forwarding profile for all rules? Or do i need to select , let's say 20 rules at a time and apply the log forwarding profile?

Re: Log Forwarding to Panorama

sjanita — Wed, 30 Jan 2019 09:16:22 GMT

to use the multi edit option you need to select the policies you want to edit.

You can expand the default view of 50 policies to 500 for example, and select 500, if you do not want to make changes in 50 count batches.

Re: Log Forwarding to Panorama

MGRashmi — Thu, 31 Jan 2019 06:36:01 GMT

Hi sjanita,

Thanks a lot for your response. I will do that.

Re: Log Forwarding to Panorama

AK74 — Mon, 26 Sep 2022 12:32:45 GMT

Hi there,

We migrated ASA policy security rules to PA firewall, and now we want to amend these policies rules to add both log forwarding profile or Security profiles.

So, if I connect the FW to Expedition tool (or simply upload FW XM config into Expedition), ingest policies, multi-rule edit, then API push the rules back to the FW, will the new amended policy rules override the current existing rule when I use API (load partial config) or crate duplicated ones ?

thanks

Re: Log Forwarding to Panorama

lychiang — Mon, 26 Sep 2022 15:36:35 GMT

@AK74 Yes, it will overwrite whatever you have on firewall , you can either push the modified rules back to firewall via API calls or use load config partial in replace mode.