topic configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device in Panorama Discussions

configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

akilgolandaz — Tue, 02 Jan 2024 05:35:08 GMT

I need help to configure log forwarding on firewall to Panorama but I dont want to add the firewalls to Panorama

configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

Re: configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

reaper — Tue, 02 Jan 2024 23:59:04 GMT

The firewall needs to be connected to panorama to receive the correct log collector configuration.

The log collector get's a list of firewalls that are allowed to send log to it from the managed devices, and managed devices are instructed which collector is their primary log forwarding target etc.

This cannot be achieved without attaching a firewall to panorama managed devices (you are not required to push any configuration onto the managed firewall, if that is your worry)

Re: configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

akilgolandaz — Wed, 03 Jan 2024 07:06:32 GMT

Thanks Reaper, due to some restriction in our environment we are not allowed to add few firewalls to Panorama as managed devices.

I know is not a normal practice and its an exceptional configuration we need to achieve the goal.

Re: configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

vsurresh — Wed, 03 Jan 2024 10:40:46 GMT

You can do it but you still need to add the firewall as a managed device but don't add it to any templates or device-groups. I've done this recently for the same purpose of getting the logs into Panorama without managing it.

Re: configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

akilgolandaz — Wed, 03 Jan 2024 12:00:56 GMT

Hi Vsurresh,
thank you for your response.

So to accomplish the requirement, I need to add the firewall under Panorama > Managed devices

But I should not add the firewall in any template or device groups

Correct !

Re: configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

vsurresh — Wed, 03 Jan 2024 12:06:57 GMT

I can't remember exactly what I did but these are the steps I took looking at my notes.

Add both Panorama IPs to the firewall and leave all other settings at default
Add the firewall serials to Panorama
Add the firewall to the log collector group
Create a log forwarding profile called ‘default’ which forwards all the traffic logs to Panorama.
Add the log forwarding profile to all the security rules
A firewall is not added to any device groups or templates on Panorama

Re: configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

reaper — Wed, 03 Jan 2024 23:07:10 GMT

indeed, the firewall does not need to be member of a device group or template, but it does need to be in 'managed devices' to get the colector configuration sent to it

Re: configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

akilgolandaz — Thu, 04 Jan 2024 05:18:19 GMT

Thank you Vsurresh

Re: configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

akilgolandaz — Thu, 04 Jan 2024 05:18:49 GMT

Got it Tom Piens