topic Re: TLS syslog to a cloud based SIEM in General Topics

TLS syslog to a cloud based SIEM

ryupapa — Tue, 21 Jan 2020 21:59:19 GMT

Running software version 8.1.10 on this PA firewall.

I have the TLS syslog server profile setup in Configuration type logs and that works (getting config logs).
Then I setup this log forwarder profile that has both TLS syslog and UDP syslog server profiles.
When using adding logging for each line of policy to log on session close with the aforementioned log forwarding profile. Only my UDP syslog collector is getting logs.

Anyone else have any challenges getting this working?

Re: TLS syslog to a cloud based SIEM

kiwi — Wed, 22 Jan 2020 09:44:38 GMT

Hi @ryupapa ,

I'm assuming that the TLS syslog server and profile is setup correctly seeing that it's getting the config type logs just fine.

You should be able to configure upto 4 servers in a single profile... I don't see why it wouldn't work.

Does it work if you add ONLY the TLS syslog server into the new profile ? Or is it a problem only when you add multiple servers to the profile ?

Cheers,

-Kiwi.

Re: TLS syslog to a cloud based SIEM

ryupapa — Wed, 22 Jan 2020 13:45:58 GMT

Originally I had only the TLS syslog server. For fun I made a new log-profile. Still is not working.

I was toying with the idea that Palo just doesn't want to overburden themselves with TLS syslog for traffic logs. Doesn't make sense since it is documented.....

Re: TLS syslog to a cloud based SIEM

ryupapa — Wed, 22 Jan 2020 21:26:30 GMT

Looking at packet captures...

the firewall establishes 3 way handshake with the SIEM for tls syslog. Waits for 106 seconds later then sends the client hello, and milliseconds after sends a FIN-ACK to the SEIM before getting the ack back the siem.

Why does it wait 106 seconds before sending the client hellp? very strange....

Again tls syslog for config and system logs work fine with the same siem.