topic Re: Panorama Version 10.0.1 Cant see Traffic logs from Palo-Alto Device in General Topics

Panorama Version 10.0.1 Cant see Traffic logs from Palo-Alto Device

itaymel — Sun, 18 Oct 2020 13:39:44 GMT

Hi Guys,

Devices:

1. Panorama Version 10.0.1 Model VMware ESXi

2. Palo Alto Cluster Active/Passive Version: 10.0.1 Model: VMware ESXi VM License: VM-100

Problem:

Logs that send from Palo alto to panorama cant be seen under the monitor Traffic tab and cant be sent to the Syslog server.

directly from the Palo alto, we can see the logs under monitor tab traffic and also if we config that Palo alto will send the logs directly to the Syslog server we can see the logs in the Syslog server.

I look in Panorama > Log Settings and I can't see the "Traffic" tab in the old PAN version 9 there was a "Traffic" tab that all the logs that match there can be seen in the monitor section.

old version:

Did the Syslog config in PAN 10 been a change or there is a special config for Palo Alto Cluster that sends logs to panorama?

Re: Panorama Version 10.0.1 Cant see Traffic logs from Palo-Alto Device

iscott — Fri, 06 Nov 2020 21:37:21 GMT

Hello, @itaymel

Hope you are doing great!

Have you checked the configuration in the firewall?

1. Server Profile (to send logs to Panorama, doesn't apply).

2. Log Forwarding Configuration (in the same profile you can configure to send logs to Panorama and Syslog Server).

3. Have you attached the Log Forwarding option to Security Policies?

4. Also, have you verified if the Firewall is managed by the Panorama Server after the upgrading?

Panorama > Log Settings does not apply because these are logs from Panorama, that you want to send to external services:

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/panorama-web-interface/panorama-log-settings.html

Regards,

Re: Panorama Version 10.0.1 Cant see Traffic logs from Palo-Alto Device

itaymel — Tue, 10 Nov 2020 15:04:28 GMT

Hi iscoot,

I manage to found out what was the problem.

the problem was that mode of the panorama device was config as Management Only mode I have to change the mode to

Panorama mode and the to config collector and after this I can see all the logs in the panorama device.

https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/panorama-overview/panorama-models.html

Re: Panorama Version 10.0.1 Cant see Traffic logs from Palo-Alto Device

iscott — Tue, 10 Nov 2020 18:03:39 GMT

Hello, @itaymel

Yes, that was something strange to understand when I started with Panorama.

Thanks to share your resolution!

Regards,