Configure Panorama as standalone syslog server

Beaverdad73 — Tue, 17 Oct 2023 13:44:58 GMT

Hi,

my customer would like use a Panorama device as standalone syslog server (using standard syslog tcp/udp port 514), so that it can collect logs for firewalls it does not manage.

Is it possible?

So we can configure on the Panorama that manage the firewalls, a syslog server profile pointing the ip address of the standalone syslog server Panorama (that doesn't manage the FWs). Which port we need to use and which syslog format (BSD or IETF)?

Thanks

Max

Re: Configure Panorama as standalone syslog server

PavelK — Tue, 17 Oct 2023 21:04:40 GMT

Hello @Beaverdad73

Firewall needs to be registered in Panorama to be able to send logs to Panorama. You do not have to use Device Group / Template Stack configurations to manage Firewall from Panorama, but Firewall's serial number needs to be at least registered and assigned to log collector group to get logs.

If you mean scenario to configure a Firewall with syslog profile pointing to Panorama's IP address and use Panorama as a syslog server, I do not think this is going to be working. Panorama does not ingest 3rd party logs.

Kind Regards

Pavel

topic Re: Configure Panorama as standalone syslog server in Panorama Discussions

Configure Panorama as standalone syslog server

Re: Configure Panorama as standalone syslog server