topic Logging Question in General Topics

Logging Question

Grubbsy — Mon, 17 Nov 2014 14:42:20 GMT

We recently switched from a Cisco ASA 5520 to the PA3020.

On the ASA, I could see a real time log of incoming and outgoing connections, blocked or allowed. This was a very handy tool to verify connectivity.

I have been unable to locate a similar log in the Palo Alto. The traffic log is not through at all. It doesn't show all traffic. Is there a way to see everything that is outgoing and incoming other than the traffic log?

Jason

Re: Logging Question

ssharma — Mon, 17 Nov 2014 14:44:44 GMT

Hi Grubbsy ,

You can access Monitor -> Session Browser for real time traffic. You can also filter based on source, destination or ports. Hope this helps. Thank you.

Re: Logging Question

HULK — Mon, 17 Nov 2014 14:50:01 GMT

Hello Grubbsy,

FYI. ( note: you may also add filters based on ingress/interfaces, security rules etc)

You may also check the real time session in the CLI by using 'show session all filter source IP_ADD_OF_THE_TESTING_PC destination IP_ADD_OF_THE_DESTINATION'.

> If there is a session exist for the same traffic, then please apply CLI command PAN> show session id XYZ >>>>>>>> to get detailed information about that session, i.e NAT rule, security rule, ingress/egress interface etc.

Hope this helps.

Thanks

Re: Logging Question

Grubbsy — Mon, 17 Nov 2014 14:51:48 GMT

Thanks SSharma, thats what I was looking for!