Have few questions on log forwarding ..
1. Is there any best option to check what are the policy rules doesn't configured with log forwarding from Panoroma or any other tools ?
2.How to enforce users to specific custom log forwarding profile
3. is there any alert system we can configure if user configure policy without log forwarding profile .
Here are my replies:
1. If you set the log forwarding profile name to 'default', then every policy should be setup with it:
2. Not entirely sure what you are asking, could you expand on your question?
3. I think this is what you are looking for: You can setup email alerts to alert for specific things, e.g. when a configuration change is made: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGjCAK
Hope this helps.
1. i have 200+ policy rules on environment ,how can i check one by one policy if fwd profile configured or not ? is there simple option to validate compliance [ if someone missed add fwd profile on rule]?
2. i mean , take example i have multiple fwd profile [defult ,fwd_1,fwd_2 etc] on panorama but want make restrictions like user should always use fwd_2 profile otherwise they cant configure policy rule.
3. email notification im looking more if someone missed to add fwd profile ,how to enable email for that ?
All very good questions, however not sure its possible for questions 2 and 3. For question 1. You can filter the security policies to see which ones have for dont have log policies:
Just put an n in front of the eq ( example (log-setting neq 'Logforwarding')) if logfrowarding was the name of the profile.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!