Traps - Panorama log ingestion Integration

[mmelone]

Hi, 

I have Panorama 8.0.1 set to panorama mode. I'm trying to send Traps ESM logs to Panorama. I feel like my configuration is correct, but the connection fails from the Traps side.  Am I missing anything?  See Screenshots of my Panorama Traps Log Ingestion Profile and Traps ESM Panorama Configuration.

[Willian]

The following procedure should work fine.

In order to take advantage of Panorama 8.0; do the following:

If you have a M100 or M500, update the software, and you're good.

If you have a Panorama-VM, there is a few more steps:

1. Make sure you have enough vCPUs and RAM:  8vCPUs and 16GB RAM minimum
2. Update the software
3. Depending on your configuration, it might want more disk. Running the request system system-mode panorama will tell you how much, and how to migrate.
4. Add disks as necessary, migrate with request system clone-system-disk target <yourdisk> and lean back
5. Once done, reboot, and run request system system-mode panorama again
6. Panorama will convert logs to the new format in the background. For production systems, consider doing this in low-activity periods, for instance during the night.

Voilá:

https://live.paloaltonetworks.com/t5/Rome-Discussions/Panorama-8-0-How-to-switch-to-the-new-Panorama...

I hope it helps.

[mmelone]

I think i found my issue on step 4 here. Will post back with more info.

https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/monitor-network-activ...

[mmelone]

Willian,

I have already upgraded Panorama to panorama mode. It seems like port 23001 isnt open on Panorma even though i added the log collector profile and log ingestion profile from the document.

https://www.paloaltonetworks.com/documentation/80/panorama/panorama_adminguide/monitor-network-activ...

[mmelone]

I was able to successfully connect after specifying Traps Ingestion Profile in the default Log Collector Group.