topic Re: Log forwarding to PAN and syslog? in General Topics

Log forwarding to PAN and syslog?

drewdown — Mon, 16 Apr 2018 15:15:33 GMT

I use panorama to configure and push policies as well as log forwarding (to the panorama) for all my firewalls. I now want to send all those logs (traffic, threat, data, etc..) to a syslog server as well but running into a problem when doing this. It seems I can't push/create a syslog server on the PAN and add it to the 'panorama log forwarding' profile.

If I create a syslog server profile on the PAN it doesn't show up under > Log Forwarding > Forward to Panorama > Log Forwarding Profile > Traffic (or any other log) > Syslog.

So because I do all this from the PAN I can't seem to figure out how to push all logs to the PAN and a syslog server at the sametime. The only way I think I can do it is by doing the policies locally on the firewall which then defeats the entire purpose of the PAN.

Anyone run into this before?

Re: Log forwarding to PAN and syslog?

Brandon_Wertz — Mon, 16 Apr 2018 15:35:20 GMT

Is there a reason you can't FW your logs from Panorama to your syslog device? (That's what I do)

Re: Log forwarding to PAN and syslog?

Remo — Mon, 16 Apr 2018 15:54:58 GMT

Did you configure the syslpg server profile in the shared context or for a specific vsys? And in addition: the log forwarding profile also must be greated in shared context and not in a device group in order to make it work.

Re: Log forwarding to PAN and syslog?

drewdown — Mon, 16 Apr 2018 16:03:31 GMT

@RemoProblem is the syslog server profile is NOT shared on the Panorama. It seems to be local and not even able to assign it on the panorama. The log forwarding is created under a 'Branches' DG which includes all of my sites.

@Brandon_Wertz Only reason is I was trying to forward only a single sites logs and not all of them. Can you post a screenshot of you have it configured?

Re: Log forwarding to PAN and syslog?

Remo — Mon, 16 Apr 2018 16:35:54 GMT

I have the same config here. I have the syslog server profile on all firewalls in a global template, even if I do not need in on all devices. And obviously I also don't need the log forwarding profile on all firewalls, but creating it in shared devicegroup context is the only working solution. And because the forwarding profile is created in shared context it will be pushed to all firewalls - even if it is not used - which the other way requires the syslog profile on all firewalls for not getting commit errors because of deoendencies.

Re: Log forwarding to PAN and syslog?

drewdown — Mon, 16 Apr 2018 17:23:24 GMT

Figured out why, I didn't have any 'Templates' configured on the panorama. Once I configured one I was able to apply the syslog profile to the log forwarding profile. Thanks all.