Dedicated Logging Export Interface on PA 5220?

[ClarkeMorledge]

By default, I know that you can send all of your logging messages out the onboard management interface, on a platform like the 5220.  However, I would like to avoid the extra noise on my management network, by configuring separate, dedicated interfaces to handle and offload the logging operations, to remote systems.

Ideally, I would like to pair several interfaces together into a port channel (link aggregation) for this logging purpose.

My understanding is that you can do this on the PA-7000 platform.  But I am wondering how to do this on 5220. 

Specifically, how can this be done via the CLI?

Thanks.

Clarke Morledge

College of William and Mary

[nagarjuna.b]

You can configure the Custom "Service Route configuration" on the device for log forwarding to use the source interface as the Aggregated interface. 

Best regards,

Nagarjuna 

[reaper · Accepted solution]

the PA-7000 can do this if you insert the Log-Forwarding Card and then you have a dedicated log forwarding blade

on the PA-5220 you can either reuse an existing dataplane connection (single interface or AG) or create a new interface (or aggregate) that connects to your log collector, and then set up Service Routes [Device > Setup > Services] to have syslogs etc egress out that interface(group)

there's 2 ways to accomplish this through CLI

setting the 'service' (in this example all management outbound 'syslog' is pushed to the new source interface)

>set deviceconfig system route service syslog source address 10.193.82.164/23
>set deviceconfig system route service syslog source interface ethernet1/3

setting a 'destination' (in this example all outbound connections for a specific management-plane destination are pushed out of a new source interface)

>set deviceconfig system route destination 10.15.15.15 source interface ethernet1/3
>set deviceconfig system route destination 10.15.15.15 source address 10.193.82.164/23