topic While integrating panorama with SIEM server( using Syslog server profile ) for log forwarding from panorama to siem server facing system alert/log on in Log Forwarding Discussions

While integrating panorama with SIEM server( using Syslog server profile ) for log forwarding from panorama to siem server facing system alert/log on

prathamesh_s — Thu, 03 Aug 2023 19:46:50 GMT

While integrating panorama with SIEM server( using Syslog server profile ) for log forwarding from panorama to siem server facing system alert/log on panorama i.e “ panorama lost it is connection to peer, No logs will be forwarded ”
Panorama version- 10.2.4
Panorama is in HA but both peer have seperate log collector.
Anyone has faced this same issue, please revert and help

Panorama

Re: While integrating panorama with SIEM tool for log forwarding facing error on SIEM tool i.e “ panorama lost it is connection to peer” Panorama ver

PavelK — Wed, 02 Aug 2023 22:53:28 GMT

Hello @prathamesh_s

could you check logs from Panorama CLI to see it can give more details about root cause of the error: tail follow yes mp-log ms.log

Kind Regards

Pavel

Re: While integrating panorama with SIEM tool for log forwarding facing error on SIEM tool i.e “ panorama lost it is connection to peer” Panorama ver

prathamesh_s — Thu, 03 Aug 2023 09:47:09 GMT

Hi , have run that command
Output
Error: pan_comm_get_tcp_conn_gen (comm_utils.c:702 ) : COMM: connot connect. Remote ip= 172.24.*.* port=3978 err=connection timed out(110) sock 19
CMSA: Source bind sock to 172.20.*.*
COMM: Souce bind sock 19 to 172.20.*.* before connect to remote ip [172.24.*.*] @port 3978

Note* = panorama is in HA , passive panorama in remote location.
Active = 172.20.*.*
Passive= 172.24.*.*

Have run this command from active panorama

Please reply

Re: While integrating panorama with SIEM server( using Syslog server profile ) for log forwarding from panorama to siem server facing system alert/lo

PavelK — Fri, 04 Aug 2023 06:22:49 GMT

Hello @prathamesh_s

thank you for reply.

Regarding the first screen shot, it looks like that there is a connectivity issue between Panorama and managed Firewall. There is a time out for TCP 3978, but eventually at the end of the log, there is a message that device has registered. To me it looks like WAN / Connectivity issue. Could you check this KB: Troubleshooting Panorama Connectivity

Regarding second screen shot with the error: "Panorama has lost...", it looks like a latency / connectivity issue between active and passive Panorama. The maximum recommended latency between both units should be below 500 ms. Here is a reference in documentation Doc. Since you mentioned that passive Panorama is in remote location, I would try to adjust HA Timers Doc.

Kind Regards

Pavel