topic Re: Best way to apply log Forwarding setting to multiple security policies in Panorama in General Topics

Best way to apply log Forwarding setting to multiple security policies in Panorama

Daryl_B — Mon, 25 Jan 2021 23:21:10 GMT

I recently migrated a few HA pairs into Panorama in my environment. Historically, our security policies were configured to only send traffic logs from deny rules to our syslog. Any allows were only logged on the local firewall (due to costs of Splunk ingesting logs). It was simple to also send those to Panorama. However, I also want to now send all my allow rules to Panorama. I created a new Log Forwarding profile for sending just to Panorama. What is the easiest way to now apply that action to my hundreds of security policies? I would prefer it be in the GUI, but I'm guessing that's not the case. Is there at least a way to do this within Panorama CLI?

Re: Best way to apply log Forwarding setting to multiple security policies in Panorama

kiwi — Tue, 26 Jan 2021 11:50:13 GMT

Hi @Daryl_B ,

I believe this exact topic was discussed here:

https://live.paloaltonetworks.com/t5/general-topics/log-forwarding-profile-in-all-security-policies/td-p/205426

Hope it helps !

-Kiwi.

Re: Best way to apply log Forwarding setting to multiple security policies in Panorama

BPry — Tue, 26 Jan 2021 21:24:00 GMT

@Daryl_B,

There's a lot of ways to do this, but you can use Expedition if you really want a way to do this directly in a GUI environment. It would probably be faster to just script it through the CLI though.