topic Re: Log forwarding to Panorama from PAN-OS Firewalls for Threats in General Topics

Log forwarding to Panorama from PAN-OS Firewalls for Threats

mr_almeida — Mon, 11 Nov 2019 09:17:44 GMT

Hi Gang,

Would like to clarify how one sees threat logs from the PAN-OS firewalls in Panorama. Panorama is deployed as follows:

system mode = management-only
VM Mode = VMware ESXi
Firewalls = PA-3020
Version = All on 8.1.10

I have configured log forwarding to Panorama but I never see any threat logs. Log forwarding profile below, it's set on policies of post-rules to perform log forwarding for the configured profile.

I check locally on PAN-OS and it does show the firewall is forwarding to Panorama.

Could I kindly ask for all your advice on this :)?

Thank you for reading!

Daniel

Re: Log forwarding to Panorama from PAN-OS Firewalls for Threats

BatD — Mon, 11 Nov 2019 09:27:53 GMT

@mr_almeida The reason you don't see the logs is, because your Panorama is in "management-only" mode and can only used for manging firewalls, but no log collection.

"Management Only mode allows the Panorama virtual appliance to operate strictly as a Panorama management server without local log collection capabilities."

https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-appliance/set-up-the-panorama-virtual-appliance-in-management-only-mode.html

Re: Log forwarding to Panorama from PAN-OS Firewalls for Threats

mr_almeida — Mon, 11 Nov 2019 09:39:08 GMT

@BatD

Thanks for the reply! Yes, I saw this and am wondering if it is ok to change it from management-mode to panorama-mode? System resources aren't an issue so that is fine. I see I would need to attach a secondary disk for logging.

https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-appliance/set-up-the-panorama-virtual-appliance-in-panorama-mode.html

Is this advisable or better to go with logging servers and then use collector groups?

Re: Log forwarding to Panorama from PAN-OS Firewalls for Threats

BatD — Mon, 11 Nov 2019 09:45:31 GMT

@mr_almeida If you have all the available resurces the easiest will be to convert to Panorama mode and start collecting logs.

It really depends on the size and design of your deployement. External log collectors can give you redundancy, additional processing power, and log collection close to the log source. However every external log collector will need additional hardware and licenses.

Re: Log forwarding to Panorama from PAN-OS Firewalls for Threats

mr_almeida — Mon, 11 Nov 2019 09:48:11 GMT

@BatD Great, thanks for the quick response and noting of the additional licences! We've only initially roled out and not a massive environment, so enabling Pan mode makes sense! Thank you very much!