topic Re: Scheduled configuration Export Firewall in General Topics

Custom Email alerts based on System logs in Panorama 8.x

Roby_Sreejith — Wed, 06 Dec 2017 13:20:17 GMT

I have configured Scheduled configuratio export for Panorama and all firewalls to an SCP server

This is done via Panorama.

Is there any way to schedule an email alert after evry succesful backup of configuration. Or in case of failed export of configuration . I can see the SCP export happening through system logs in panorama.

I have filtererd with the SCP/SFTP server IP like below: Is it possible to filter this and create email alert:( custom email Alerts):

Re: Scheduled configuration Export Firewall

kiwi — Tue, 21 Nov 2017 09:52:15 GMT

Hi @Roby_Sreejith,

I haven't checked it myself yet but if there's a log generated then you could use PAN-OS 8.0 filtered log forwarding feature to accomplish this.

Hope this helps.

Cheers !

-Kiwi.

Re: Scheduled configuration Export Firewall

Brandon_Wertz — Tue, 21 Nov 2017 13:57:10 GMT

I'm curious, maybe I don't understand what you're trying to do but Panorama automatically takes a config backup everytime you make a commit change that's attached to panorama. It stores 100 unqiue configs by default. (I'm not sure why you'd need a seperate process to export the configs?)

Re: Scheduled configuration Export Firewall

Roby_Sreejith — Tue, 28 Nov 2017 09:50:12 GMT

There is is a problem with this bacakup. It stores in Panorama. I can not extarct this to locally.

Re: Scheduled configuration Export Firewall

Brandon_Wertz — Tue, 28 Nov 2017 13:27:06 GMT

@Roby_Sreejith wrote:
There is is a problem with this bacakup. It stores in Panorama. I can not extarct this to locally.

I guess I don't understand the requirement. You need it "locally" and not in Panorama because Panorama has the potential to be inaccessible and if at that same time you have a firewall down and need to restore said firewall relying on Panorama is a failure point?

Re: Scheduled configuration Export Firewall

Roby_Sreejith — Wed, 06 Dec 2017 08:39:08 GMT

I beleive the backup in panoarama can not be extracted locally.

This stays in Panorama.

I have reqiremt of keeping a local backup copy of each firewall , so I choose an option to export to SCCP/SFTP server .

So I have control in backup procedure.

Now I need alert mechansim of which whethere this exort to SCP/SFTP server is success or not

Re: Scheduled configuration Export Firewall

Roby_Sreejith — Wed, 06 Dec 2017 13:28:29 GMT

I have added some more details in the discussion with detailed pictures.

Re: Scheduled configuration Export Firewall

Roby_Sreejith — Wed, 06 Dec 2017 13:30:02 GMT

I have added the system logs screenshot in here. Can you tell me how to create custom email alerts for this issue. or is there any guide posted here for custom alerts

Re: Scheduled configuration Export Firewall

fjwcash — Wed, 06 Dec 2017 20:40:08 GMT

@Roby_Sreejith wrote:
I beleive the backup in panoarama can not be extracted locally.
This stays in Panorama.
I have reqiremt of keeping a local backup copy of each firewall , so I choose an option to export to SCCP/SFTP server .
So I have control in backup procedure.
Now I need alert mechansim of which whethere this exort to SCP/SFTP server is success or not

If it's not possible via Panorama, you can always script something up on the SCP/SFTP server side of things. The auth log for SSH will show whether a connection occurred. And you should be able to increase the verbosity of logs for SCP/SFTP connections to show more information on the connections/transfers.

You can always monitor the directory the files are being transferred to, and compare dates/times on the files. And/or the file names, as they are named using the date of the backup.

Re: Scheduled configuration Export Firewall

Roby_Sreejith — Thu, 14 Dec 2017 10:05:39 GMT

Is it possible to a custom report ands schedule an email in Palo Alto onbnly for succesful /failed SCP SFT backup done from Panorama

Re: Custom Email alerts based on System logs in Panorama 8.x

T-Squared — Thu, 14 Dec 2017 21:13:12 GMT

Yes this is possible using http server profiles and an external service called mailgun, I do it for commits.

Re: Custom Email alerts based on System logs in Panorama 8.x

Roby_Sreejith — Fri, 15 Dec 2017 06:36:23 GMT

Can you help which document to refer for this

Re: Custom Email alerts based on System logs in Panorama 8.x

Roby_Sreejith — Tue, 19 Dec 2017 06:21:38 GMT

any idea to configure email alert for this

Re: Custom Email alerts based on System logs in Panorama 8.x

T-Squared — Tue, 19 Dec 2017 21:58:22 GMT

Here is something that should help, I will keep it up till EOY.

Tom

https://www.dropbox.com/s/18yo3d0k3qbxq8a/Mail-forwarding.pdf?dl=0

Re: Scheduled configuration Export Firewall

Roby_Sreejith — Thu, 12 Apr 2018 09:05:04 GMT

@kiwi I have checked and could not find this feature for filtering System logs, Have you tried this to filter system logs for specific pattern to crerate email alerts

Re: Scheduled configuration Export Firewall

kiwi — Thu, 12 Apr 2018 11:35:36 GMT

@Roby_Sreejith,

For forwarding filtered System Logs :

Device tab (or Panorama tab on Panorama) > Log Settings > System (+Add) > Filter Builder :

Cheers !

-Kiwi.

Re: Scheduled configuration Export Firewall

Roby_Sreejith — Wed, 18 Apr 2018 12:46:42 GMT

Thanks so much for this information