topic Re: Panorama Log Collector Forwarding Traffic Strings in Panorama Discussions

Panorama Log Collector Forwarding Traffic Strings

ElliotM — Thu, 16 Jun 2022 10:29:57 GMT

Hi All,

Currently we have set up to forward all logs to an external log collection service. Due to the cost we would like to reduce the traffic logs that we are forwarding.

The traffic logs we wish to exclude from being forwarded are the below:

DNS traffic to 10.0.0.0/8

DNS traffic to 8.8.8.8

DNS traffic to 8.8.4.4

Ping traffic from 10.29.100.1

Ping traffic from 10.29.100.2

Ping traffic from 10.29.100.3

Kerberos traffic to 10.0.0.0/8

I have tried using the below string (and many variations) however it either doesn't filter out the above or only filters shows the above!

I think my issue is a case of not putting the () in the correct places?

( app eq dns ) and ( addr.dst notin 10.0.0.0/8 ) and ( addr.dst notin 8.8.8.8 ) and ( addr.dst notin 8.8.4.4 ) and (( app eq ping ) and ( addr.src notin 10.29.100.1 ) or ( addr.src notin 10.29.100.2 ) or ( addr.src notin 10.10.29.100.3 )) and (((app eq kerberos) and ( addr.dst notin 10.0.0.0/8 )))

Thanks for any assistance

Re: Panorama Log Collector Forwarding Traffic Strings

PavelK — Thu, 16 Jun 2022 12:54:13 GMT

Hello @ElliotM

thanks for the post.

Could you check whether this string works for your filter?

!(( app eq dns ) and (( addr.dst in 10.0.0.0/8) or ( addr.dst in 8.8.8.8) or ( addr.dst in 8.8.4.4))) and !(( app eq ping ) and (( addr.src notin 10.29.100.1) or ( addr.src notin 10.29.100.2) or ( addr.src notin 10.10.29.100.3))) and !(( app eq kerberos ) and ( addr.dst notin 10.0.0.0/8))

Kind Regards

Pavel

Re: Panorama Log Collector Forwarding Traffic Strings

ElliotM — Mon, 20 Jun 2022 13:31:38 GMT

Hi @PavelK ,

Thanks for replying however it doesn't seem to work as expected.

I don't see ANY dns traffic to other destinations and i am also still seeing kerberos traffic.

Re: Panorama Log Collector Forwarding Traffic Strings

PavelK — Tue, 21 Jun 2022 11:50:51 GMT

Thank you for reply @ElliotM

for dns log part, I tested it in my Panorama and I got desired result, so I am not sure what the issue is. For other part, I changed syntax. Could you test below string?

!(( app eq dns ) and (( addr.dst in 10.0.0.0/8) or ( addr.dst in 8.8.8.8) or ( addr.dst in 8.8.4.4))) and !(( app eq ping ) and (( addr.src eq 10.29.100.1) or ( addr.src eq 10.29.100.2) or ( addr.src eq 10.10.29.100.3))) and !(( app eq kerberos ) and ( addr.dst eq 10.0.0.0/8))

Kind Regards

Pavel

Re: Panorama Log Collector Forwarding Traffic Strings

ElliotM — Tue, 21 Jun 2022 10:31:20 GMT

Hi @PavelK

This is working as expected from what i can see, thanks for the help.