topic Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100) in Panorama Discussions

Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

Fatema — Tue, 29 Aug 2017 16:41:38 GMT

Hi PA Experts!

Another issue I stumped upon yesterday 😞

We replaced one of our PA firewall 5050 to PA 5220 couple of days ago, and when I am trying to find the

traffic logs corresponding to that PA 5220 device on Panorama, it shows nothing.

I duoble checked the configuration on Panorama and the device PA to see everything is setup correctly for forwarding logs.

Also, the device is setup to send the threat logs to a log aggregation system, and we see the syslogs successfully getting logged to the aggregator. Hence the device fw is able to send the syslogs to another system, but Panorama.

Some more specifics:

The device PA 5220 is running s/w version: 8.0.4

The Panorama is a VM and running: 8.0.4

Ran 'show logging-status device <device-ID>' on Panorama, outputs nothing 😞

Ran 'show logging-status' on the device PA, shows isn't forwarding.

Is there any tweaks that need to be done additionally for the device PA to send the logs to Panorama?

Any help appreciated 🙂

Thanks,

Fatema.

Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

jvalentine — Tue, 29 Aug 2017 16:50:17 GMT

Did you add the 5220's serial # to the "Managed Devices" tab of Panorama?

Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

Fatema — Tue, 29 Aug 2017 17:02:29 GMT

Yes, I can see the device fw 5220 in the "Managed Devices" tab of Panorama, with all the columns

displaying correct information.

Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

jvalentine — Tue, 29 Aug 2017 17:17:30 GMT

A couple of other things to verify:

1.) Is Panorama running the same (or newer) PAN-OS version as the 5220?

2.) Did you edit your collector group and configure log forwarding preferences for the new 5220?

Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

Fatema — Tue, 29 Aug 2017 17:29:59 GMT

Thanks for the comments. Here are the answers:

1. Yes the Panorama and the device are running same PANOS version (8.0.4)

2. We do not have entries for Managed Collectors or the Collector Group, but we have configured the log forwarding to Panorama by adding a Log forwarding Profile in Objects > Log Forwarding, and have the 'Shared' check-box cecked, to apply the log Frwding settings to all managed devices. We have the traffic logs from other devices logged to Panorama, it's just this current new fw device that is not logging to Panorama...

Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

jvalentine — Tue, 29 Aug 2017 18:22:13 GMT

Can you take a screenshot of your log forwarding profile and post it here?

Is this same log forwarding profile referenced in the firewall's security policy?

Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

Fatema — Tue, 29 Aug 2017 18:31:09 GMT

Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

Fatema — Tue, 29 Aug 2017 19:52:29 GMT

Ah finally got it working, by referning to this doc:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Palo-Alto-Networks-Firewall-not-Forwarding-Logs-to-Panorama-VM/ta-p/59799

Not sure what made it work, but was trying the steps 1-6 multiple time, w/o any change in the console output of 'show logging-status', but when I took a look at the Panorama, the logs were getting displayed for that device fw. (Not sure why the status commands still show nothing on the console though. hmm)

Thanks for all the help! 🙂

Fatema.

Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

FarzanaMustafa — Wed, 06 Feb 2019 22:19:52 GMT

Hi,

did you run the command on Panorama or the firewalls?

Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

FarzanaMustafa — Wed, 06 Feb 2019 22:30:32 GMT

Hi @jvalentine

As per the link https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFCCA0

where do we need to run the commands? On Panorama or on the firewalls?

Re: Palo Alto Networks Firewall not Forwarding Logs to Panorama (VM and M-100)

rarce10 — Wed, 30 Jun 2021 13:29:27 GMT

On Panorama