topic Re: log forwarding in General Topics

log forwarding

SrinivasRao — Fri, 03 Jun 2022 12:22:27 GMT

Team,

Have few questions on log forwarding ..

1. Is there any best option to check what are the policy rules doesn't configured with log forwarding from Panoroma or any other tools ?

2.How to enforce users to specific custom log forwarding profile

3. is there any alert system we can configure if user configure policy without log forwarding profile .

Thx

Srini

Re: log forwarding

OtakarKlier — Fri, 03 Jun 2022 15:03:40 GMT

Hello,

Here are my replies:

1. If you set the log forwarding profile name to 'default', then every policy should be setup with it:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/monitoring/configure-log-forwarding

2. Not entirely sure what you are asking, could you expand on your question?

3. I think this is what you are looking for: You can setup email alerts to alert for specific things, e.g. when a configuration change is made: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGjCAK

Hope this helps.

Re: log forwarding

SrinivasRao — Fri, 03 Jun 2022 15:26:47 GMT

1. i have 200+ policy rules on environment ,how can i check one by one policy if fwd profile configured or not ? is there simple option to validate compliance [ if someone missed add fwd profile on rule]?

2. i mean , take example i have multiple fwd profile [defult ,fwd_1,fwd_2 etc] on panorama but want make restrictions like user should always use fwd_2 profile otherwise they cant configure policy rule.

3. email notification im looking more if someone missed to add fwd profile ,how to enable email for that ?

Re: log forwarding

OtakarKlier — Fri, 03 Jun 2022 16:16:32 GMT

Hello,

All very good questions, however not sure its possible for questions 2 and 3. For question 1. You can filter the security policies to see which ones have for dont have log policies:

Just put an n in front of the eq ( example (log-setting neq 'Logforwarding')) if logfrowarding was the name of the profile.

Regards,