topic Re: Panorama centralised syslog forwarding ? in General Topics

Panorama centralised syslog forwarding ?

Bart_Jocque — Mon, 01 Aug 2011 09:28:32 GMT

Is the following scenario configurable :

FIREWALLS--->panoramalogging--->PANORAMA--->syslog--->SYSLOGSERVER

Usually enterprises have a Central Firewall Management infra (= Panorama ) and a SIEM infra.

But we want to avoid that individual firewalls needs to send out twice the same logs.

Re: Panorama centralised syslog forwarding ?

dburns — Wed, 03 Aug 2011 00:45:13 GMT

Currently there is no feature for panorama to forward traffic logs to the syslog server. The traffic logs have to be configured to forward logs to the syslog server via log forwarding profile.

Dominic

Re: Panorama centralised syslog forwarding ?

chrisp — Wed, 10 Aug 2011 14:32:02 GMT

Just wanted to clarify the response to this question. The log forwarding profiles would have to be created on each Firewall to send syslogs to the SIEM in addition to sending logs to Panorama? There is no way to use Panorama as a central point for forwarding all the firewall logs to a SIEM?

Thanks,

Chris

Re: Panorama centralised syslog forwarding ?

mschuricht — Wed, 10 Aug 2011 15:57:29 GMT

Chris,

You could create the log forwarding profile in Panorama and push it to the devices. Then you can use the log forwarding profile on rules on the device or in Panorama pushed rules so the profile is centrally managed.

There is no way to use Panorama as the syslog forwarding point for traffic logs.

Re: Panorama centralised syslog forwarding ?

yesitisme_007 — Wed, 10 Aug 2011 17:01:07 GMT

Can we get this functionality added in a future release of PANORAMA?

Re: Panorama centralised syslog forwarding ?

mschuricht — Wed, 10 Aug 2011 17:13:06 GMT

Please work with your SE to file a feature request.

Re: Panorama centralised syslog forwarding ?

junaid.khan — Wed, 15 Feb 2012 23:37:13 GMT

Just wondering if this feature request was ever implemented. We are also in the same boat. We got Panorama 4.1.2 and Firewall devices, They all sending traffic/threat/datafiltering and other logs to Panorama, We would like to see if the same logs could be forwarded to SIEM.

Appreciate the answer.

Thanks

Junaid

Re: Panorama centralised syslog forwarding ?

mschuricht — Wed, 15 Feb 2012 23:47:34 GMT

Unfortunately this FR has not been implemented yet.

Re: Panorama centralised syslog forwarding ?

mikand — Thu, 16 Feb 2012 06:08:52 GMT

But is it on the roadmap or does all customers need to contact their sales rep for this to happen?

Re: Panorama centralised syslog forwarding ?

GobiernodeNavarra — Thu, 16 Feb 2012 08:17:48 GMT

We requested this feature to our sales rep a year ago.

Re: Panorama centralised syslog forwarding ?

mschuricht — Thu, 16 Feb 2012 16:51:08 GMT

This request has been around for quite some time. We analyze feature request (FR), strategic requirements, and enhancement ideas before each release. We then propose a set of reqs for a release and review with engr. Priorities, resource capacity, and difficulty are used to thin the list of reqs to what ends up being delivered.

This particular req has made it to the short list a couple time and never through the final phase where it would end up in Panorama. We are continuing to push for inclusion since it is both requested by customers frequently and strategic.

Please ask your SE for more details about the FR process if you have more questions.

Re: Panorama centralised syslog forwarding ?

broadleyn — Thu, 26 Jul 2012 16:41:02 GMT

Kind of makes me wonder what the point of Panorama is, given that we don't use shared rules. Might be one for us to drop maintenance for actually. We get no value from our deployment of this service.

I'll speak to our account rep regarding the future of this product.

Re: Panorama centralised syslog forwarding ?

mschuricht — Thu, 26 Jul 2012 17:19:10 GMT

Panorama is essential when you have many firewalls to manage and administering each device independently no longer scales. We see customers beginning to use Panorama for centralized configuration management when they have 6-10 devices. These customers utilize it for aggregate deployment visibility, configuration management, and maintenance.

Some smaller customers with less devices will use Panorama to provide centralized visibility over their devices though log forwarding because they like our reporting, log viewing, and ACC functionality. These customers will also use it for maintenance to push SW, content, and client updates from Panorama centrally. In this case it is less about centralized configuration management as you pointed out for your enterprise currently.

Syslog collectors are important for many customers and can augment the capabilities of Palo Alto Networks devices as well as Panorama. If the Syslog forwarding from Panorama were to be implemented in a future release, we hope Panorama would be utilized for more than just Syslog relay functionality.

Re: Panorama centralised syslog forwarding ?

broadleyn — Fri, 27 Jul 2012 10:53:05 GMT

Thanks for the clarification, Mike. I'm still struggling to see value in Panorama in terms of administrating multiple devices personally - the pre/post policy rules are clunky and we haven't found the Threat/AV updates to be reliable, so the main selling points for us was the unified log. But since we have a SIEM tool, Solarwinds Orion, Panorama and Tufin SecureTrack all demanding syslog from the firewalls in order to provide various functionality, we have the firewalls generating between 3000 and 10,000 sessions of syslog continually, hammering the management plane and swamping the service-route NIC.

It shouldn't be the firewall's job to send syslog to multiple sources - it's the management device's job to do so. That Panorama can't do this reduces it to a minor convenience tool. In fact, since our main firewalls are active/standby, the only time Panorama is accessed is when we have a failover event, which is to say, almost never.

As I say, I'll raise this with our account manager, ditch Panorama from our maintenance contact next cycle and if it's ever developed in a more useful direction, we'll revisit the decision.

Re: Panorama centralised syslog forwarding ?

stoltze — Wed, 05 Jun 2013 09:20:57 GMT

Hi,

Seems to remember that PA talked about syslog forwarding from Panorama to syslog server, including logs from firewalls at the SE Tech Update in Helsinki a few months ago..

But I can't find anything about in Panorama 5.1..?

Has this still not been implemented...?

Regards,

Niels Stoltze

Re: Panorama centralised syslog forwarding ?

mschuricht — Wed, 05 Jun 2013 15:54:34 GMT

Panorama Syslog forwarding of Device forwarded logs is not in the 5.1 release.

Please talk with your SE about any roadmap related inquiries.

Re: Panorama centralised syslog forwarding ?

bjocque — Thu, 06 Jun 2013 13:04:55 GMT

We have been asking for this since 3.0 ;-(

Re: Panorama centralised syslog forwarding ?

mschuricht — Thu, 06 Jun 2013 20:22:04 GMT

Please talk with your SE about any roadmap related inquiries.

Re: Panorama centralised syslog forwarding ?

supporton2it — Tue, 22 Oct 2013 11:32:22 GMT

A long-standing request, and an important one, since Panorama is not a qualifying platform where log retention/sanitation/deletion compliance regulations are in effect.

Bumping it again to the SE.

Re: Panorama centralised syslog forwarding ?

bjocque — Tue, 22 Oct 2013 11:39:10 GMT

Feature request ID is 782 😉