topic Re: Is it possible to set Log Forwarding profile on ALL existing policies in General Topics

Is it possible to set Log Forwarding profile on ALL existing policies

rpainter — Tue, 26 Apr 2016 18:50:23 GMT

So, we have been handed down a new requirement that ALL traffic logs must be forwarded to a new syslog server. I've created the server profile and log forwarding profile on my firewalls. My question is:

Is there an easy way to add the log forwarding profile to ALL of my exixting policies? Or, am I going to have to do this one policy at a time? I do use Panorama to manage all of my firewalls if that makes a difference.

Thanks for your help!

Re: Is it possible to set Log Forwarding profile on ALL existing policies

rpainter — Tue, 26 Apr 2016 23:23:28 GMT

To answer my own question:

It is NOT possible to set the profile on all existing policies at one time. You must add it to each policy individually. However, follow these instructions to set a default profile, and future policies will have the profile added automatically.

https://www.paloaltonetworks.com/documentation/61/pan-os/newfeaturesguide/management-features/default-profile-group-and-log-forwarding-settings

Re: Is it possible to set Log Forwarding profile on ALL existing policies

Raido_Rattameister — Wed, 27 Apr 2016 09:05:47 GMT

Not through web interface but you can export config out.

It is one single xml file.

Device > Setup > Operations > Export configuration version

Pick latest one from droppdown and click ok.

Then open this xml in your favorite text editor.

Find area between:

<rules>

and

</rules>

</security>

Everywhere you see "</entry>" and log-setting config does not precede:

Then replace this with:

<log-setting>Log-Forwarding-Policy</log-setting>

</entry>