Log forwarding to Panorama from PAN-OS Firewalls for Threats

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Log forwarding to Panorama from PAN-OS Firewalls for Threats

L2 Linker

Hi Gang,

 

Would like to clarify how one sees threat logs from the PAN-OS firewalls in Panorama. Panorama is deployed as follows:

 

  • system mode = management-only
  • VM Mode = VMware ESXi 
  • Firewalls = PA-3020 
  • Version = All on 8.1.10

I have configured log forwarding to Panorama but I never see any threat logs. Log forwarding profile below, it's set on policies of post-rules to perform log forwarding for the configured profile.

clipboard_image_0.png

I check locally on PAN-OS and it does show the firewall is forwarding to Panorama. 

 

Could I kindly ask for all your advice on this :)?

 

Thank you for reading!


Daniel

 

1 accepted solution

Accepted Solutions

@mr_almeida If you have all the available resurces the easiest will be to convert to Panorama mode and start collecting logs.

It really depends on the size and design of your deployement. External log collectors can give you redundancy, additional processing power, and log collection close to the log source. However every external log collector will need additional hardware and licenses. 

View solution in original post

4 REPLIES 4

L4 Transporter

@mr_almeida The reason you don't see the logs is, because your Panorama is in "management-only" mode and can only used for manging firewalls, but no log collection. 

 

 

"Management Only mode allows the Panorama virtual appliance to operate strictly as a Panorama management server without local log collection capabilities."

 

https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/set-up-panorama/set-up-the-panorama-vi...

@BatD 

 

Thanks for the reply! Yes, I saw this and am wondering if it is ok to change it from management-mode to panorama-mode? System resources aren't an issue so that is fine. I see I would need to attach a secondary disk for logging. 

 

https://docs.paloaltonetworks.com/panorama/8-1/panorama-admin/set-up-panorama/set-up-the-panorama-vi...

 

Is this advisable or better to go with logging servers and then use collector groups?

@mr_almeida If you have all the available resurces the easiest will be to convert to Panorama mode and start collecting logs.

It really depends on the size and design of your deployement. External log collectors can give you redundancy, additional processing power, and log collection close to the log source. However every external log collector will need additional hardware and licenses. 

@BatD Great, thanks for the quick response and noting of the additional licences! We've only initially roled out and not a massive environment, so enabling Pan mode makes sense! Thank you very much!

  • 1 accepted solution
  • 3913 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!