Bandwidth Requirement and Panorama

[SeanDeHarris]

Hello Experts,

We got 12+ NGFW worldwide, under Panorama Management (for logging only). Some of the sties have limited bandwidth. 

1. Is it necessary to onboard all the firewall to SCM?

2. How much bandwidth required ? how to calculate?

3. For those sites with limited bandwidth, possible to forwarding the logs to SCM?

4. In order to limits the logs to SCM, is it possible to select certain rules to enable loggint to SCM? 

thanks

SdG

[reaper]

1. it is not required to onboard firewalls to SCM if theyre panorama managed, (important to differentiate between SCM (Strata Cloud Manager) and SLS (Strata Logging ervice). SCM is like Panorama for remote management, SLS is purely for logging)

2. you can check here for bandwidth calculation : https://docs.paloaltonetworks.com/strata-logging-service/activation-and-onboarding/planning/sizing

3. where bandwidth is a potential problem, you can restrict which logs to forward, and opt to use SLS to take advantage of cloud connectivity versus backhauling to the central log collector

4. yes, you can set different log forwarding preferences for individual security rules, you can even add filters inside the log forwarding profile so only 'interesting' logs get forwarded (e.g. only high and critical threat logs)