TLS syslog to a cloud based SIEM

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

TLS syslog to a cloud based SIEM

L1 Bithead

Running software version  8.1.10 on this PA firewall.


I have the TLS syslog server profile setup in Configuration type logs and that works (getting config logs).
Then I setup this log forwarder profile that has both TLS syslog and UDP syslog server profiles.
When using adding logging for each line of policy to log on session close with the aforementioned log forwarding profile. Only my UDP syslog collector is getting logs.

Anyone else have any challenges getting this working?

3 REPLIES 3

Community Team Member

Hi @ryupapa ,

 

I'm assuming that the TLS syslog server and profile is setup correctly seeing that it's getting the config type logs just fine.

 

You should be able to configure upto 4 servers in a single profile... I don't see why it wouldn't work.

Does it work if you add ONLY the TLS syslog server into the new profile ? Or is it a problem only when you add multiple servers to the profile ?

 

Cheers,

-Kiwi.

 
LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Originally I had only the TLS syslog server. For fun I made a new log-profile. Still is not working. 

I was toying with the idea that Palo just doesn't want to overburden themselves with TLS syslog for traffic logs. Doesn't make sense since it is documented.....

Looking at packet captures...

the firewall establishes 3 way handshake with the SIEM for tls syslog. Waits for 106 seconds later then sends the client hello, and milliseconds after sends a FIN-ACK to the SEIM before getting the ack back the siem.

Why does it wait 106 seconds before sending the client hellp? very strange....

 

Again tls syslog for config and system logs work fine with the same siem.

  • 2275 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!