topic Re: Dedicated Logging Export Interface on PA 5220? in General Topics

Dedicated Logging Export Interface on PA 5220?

ClarkeMorledge — Mon, 18 Feb 2019 21:00:21 GMT

By default, I know that you can send all of your logging messages out the onboard management interface, on a platform like the 5220. However, I would like to avoid the extra noise on my management network, by configuring separate, dedicated interfaces to handle and offload the logging operations, to remote systems.

Ideally, I would like to pair several interfaces together into a port channel (link aggregation) for this logging purpose.

My understanding is that you can do this on the PA-7000 platform. But I am wondering how to do this on 5220.

Specifically, how can this be done via the CLI?

Thanks.

Clarke Morledge

College of William and Mary

Re: Dedicated Logging Export Interface on PA 5220?

nagarjuna.b — Mon, 18 Feb 2019 21:37:48 GMT

You can configure the Custom "Service Route configuration" on the device for log forwarding to use the source interface as the Aggregated interface.

Best regards,

Nagarjuna

Re: Dedicated Logging Export Interface on PA 5220?

reaper — Tue, 19 Feb 2019 11:32:01 GMT

the PA-7000 can do this if you insert the Log-Forwarding Card and then you have a dedicated log forwarding blade

on the PA-5220 you can either reuse an existing dataplane connection (single interface or AG) or create a new interface (or aggregate) that connects to your log collector, and then set up Service Routes [Device > Setup > Services] to have syslogs etc egress out that interface(group)

there's 2 ways to accomplish this through CLI

setting the 'service' (in this example all management outbound 'syslog' is pushed to the new source interface)

>set deviceconfig system route service syslog source address 10.193.82.164/23
>set deviceconfig system route service syslog source interface ethernet1/3

setting a 'destination' (in this example all outbound connections for a specific management-plane destination are pushed out of a new source interface)

>set deviceconfig system route destination 10.15.15.15 source interface ethernet1/3
>set deviceconfig system route destination 10.15.15.15 source address 10.193.82.164/23