log forwarding

[SrinivasRao]

Team,

Have few questions on log forwarding ..

1. Is there any best option to check what are the policy rules doesn't configured with log forwarding from Panoroma or any other tools ?

2.How to enforce users to specific custom  log forwarding profile 

3. is there any alert system we can configure if user configure policy without log forwarding profile .

Thx

Srini

[OtakarKlier]

Hello,

Here are my replies:

1. If you set the log forwarding profile name to 'default', then every policy should be setup with it:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/monitoring/configure-log-forwarding

2. Not entirely sure what you are asking, could you expand on your question?

3. I think this is what you are looking for: You can setup email alerts to alert for specific things, e.g. when a configuration change is made: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGjCAK

Hope this helps. 

[SrinivasRao]

1. i have 200+ policy rules on environment ,how can i check one by one policy if fwd profile configured or not ? is there simple option to validate compliance [ if someone missed add fwd profile on rule]? 

2.  i mean , take example i have multiple fwd profile [defult ,fwd_1,fwd_2 etc] on panorama but want  make restrictions like user should always use fwd_2 profile otherwise they cant configure policy rule.

3. email notification im looking more if someone missed to add fwd profile ,how to enable email for that ?

[OtakarKlier]

Hello,

All very good questions, however not sure its possible for questions 2 and 3. For question 1. You can filter the security policies to see which ones have for dont have log policies:

Just put an n in front of the eq ( example (log-setting neq 'Logforwarding')) if logfrowarding was the name of the profile.

Regards,