topic Re: Vlan information in logs in General Topics

Vlan information in logs

u2521 — Wed, 03 Mar 2010 11:08:13 GMT

Device: PA-2050

OS: PANOS-3.0.6

I have a question about Vlan. In the different logs you cant find "source vlan" anywhere. I belive this is cause Palo Alto is a zone based firewall and you should use zones to separate different network types rather than interfaces and vlans.

However...

When doing troubleshooting, vlan information would be really good in the traffic and threat logs. And when you connect a Palo Alto using a tap port you cannot even create different zones for different vlans cause the TAP interfaces can't be assigned to vlans.

The reason i'm asking is because of this scenario:

1 Palo Alto hooked up using 1 TAP port. This TAP port contains several vlans. When i examine the logs afterward it all shows up as the security zone connected to the tap interface. I want to be able to tell which alarms triggered on what vlannumber.

/Henrik

Re: Vlan information in logs

swhyte — Wed, 03 Mar 2010 23:26:01 GMT

Hello Henrik,

currently there is nothing in our Monitor logs that allow you to filter by a vlan number.

Howerver if you click on the green button for the "add filtering expression" you will see varying filtering options that may help.

Perhaps you could filter on source/destingation ip, port, or interface.

thank you,

Stephen

Re: Vlan information in logs

u2521 — Fri, 05 Mar 2010 09:45:22 GMT

Thank you for your reply.

Unfortunately the point of checking the vlan field in the monitoring logs its to feed another system with information. This system wants vlan information in order to sort logs into separate containers. And since all traffic are coming in on a TAP port with multiple vlans interface filtering is rellly not applicable.

Since we get the logs either by syslog or scp/cli access is there a way to see the vlan information in the cli with the "show logs" or something?

And also, do you have any plans on implementing vlan information in the monitoring logs in the future?

//Henrik

Re: Vlan information in logs

mderksen — Fri, 05 Mar 2010 11:57:47 GMT

Hello Henrik,

I created a feature request for the vlan information to be added to the (traffic) logging.

Keep an eye on feature releases to see if it has been implemented :-).

Marcel

Re: Vlan information in logs

swhyte — Fri, 05 Mar 2010 14:50:34 GMT

Great..thanks.

Re: Vlan information in logs

u2521 — Tue, 09 Mar 2010 13:14:06 GMT

Great, thanks Marcel.

If you also could add it to the "threat-logs" aswell that would be super-great

//Henrik

Re: Vlan information in logs

u2521 — Wed, 26 May 2010 11:00:30 GMT

Any news on when this feature will be available?