topic Traffic originate from PaloAlto Firewall in General Topics

Traffic originate from PaloAlto Firewall

KumarRamalinga — Thu, 04 Oct 2018 20:46:00 GMT

Hello Experts - Can you clarify how to configure Paloalto firewall to source traffic from Data Interface rather than Management Interface

Scenario: When Firewall send syslog message to exernal Syslog Server, the Firewall has to be configured to have Source IP address of Internal Interface instead of Management Interface. It is similar command in Cisco IOS "logging source interface"

Regards/RB

Re: Traffic originate from PaloAlto Firewall

Brandon_Wertz — Thu, 04 Oct 2018 21:12:18 GMT

It's in the "service routes"

Pan-OS 8.0.X

Device --> Setup --> Services tab --> "Service Route Configuration" link

Re: Traffic originate from PaloAlto Firewall

KumarRamalinga — Thu, 04 Oct 2018 21:28:59 GMT

Thank you

Re: Traffic originate from PaloAlto Firewall

KumarRamalinga — Thu, 04 Oct 2018 22:09:20 GMT

In relation that, can you tell me why the logs are not showing in Firewalls when i do a Ping from Firewall to any IP address. Is it a known behavior. What is the way to get those logs.

For example, when i Ping 4.2.2.2 from the firewall, those logs are not found in the Monitor section of the firewall

Re: Traffic originate from PaloAlto Firewall

Brandon_Wertz — Fri, 05 Oct 2018 16:58:34 GMT

If you're asking about logs for the management port showing up in traffic logs? That doesn't happen.

Events that occurred from the management port are seen in the "system" logs.

Re: Traffic originate from PaloAlto Firewall

KumarRamalinga — Fri, 05 Oct 2018 17:10:57 GMT

Hey - Thanks

I did a quick test now. In CLI of the Firewall i did ping to 4.2.2.2. I dont see that in the system Log

Monitor->Logs->system. the logs are not listed here. Can you help me where is the gap

Re: Traffic originate from PaloAlto Firewall

fjwcash — Fri, 05 Oct 2018 23:18:10 GMT

That's not completely true. It depends what network your management interface is connected to, and what subnet you give it an IP from. If you give the management interface an IP on the "lan" subnet, connected to the "lan" switch, with the same gateway as the "lan" traffic gets, then you will see your management traffic in the normal Traffic logs. After all, it's just another IP on the "lan".

If your management interface is connected to a separate vlan from the rest of the "normal" traffic, or if it is plugged into the "wan" side of the firewall, then the management traffic will not show in the logs anywhere, as the traffic doesn't actually pass through the firewall.

Re: Traffic originate from PaloAlto Firewall

KumarRamalinga — Sun, 07 Oct 2018 15:32:47 GMT

Thanks. My case Management Interface is a seperate VLAN

Re: Traffic originate from PaloAlto Firewall

KumarRamalinga — Thu, 11 Oct 2018 14:51:16 GMT

Hello All - I practically tried to change the Source Interface for Netflow traffic as LAN interface, with the expectation to see the Netflow traffic originating from the Firewall will appear in the Traffic Logs.

It is not appearing in the log under Monitor Section. In relation to this i have two questions?

1) If i want the Firewall to send a Netflow Traffic or Syslog of firewall Interface (WAN & LAN) , should i configure a Rule to allow the Firewall to send traffic to Netflow Collector? In this case, the Source Interface for Netflow is LAN interface and Syslog is Management Interface

2) To get the Logs of the above Traffic (to ensure the Firewall is generating Syslog/ Netflow), should i configure a Allow Rule with Log Option enabled?

thanks in advance/RB