02-17-2023 12:22 AM
Hi All,
We are currently working on setting up the Azure Sentinel for our environment and Integration of PA firewalls with Sentinel is our top most priority.
However we need to understand what will be the best approach for integration.
Should we integrate independent firewalls with Azure Sentinel or Panorama with Azure Sentinel or both firewalls and Panorama with Azure Sentinel ? Also what factors drive this decision. Any leads will be helpful
Thank you
02-17-2023 06:48 PM
Hello @ShailUpadhyay
in our case, we have been using following scenario for about 3 years:
Logs are sent from Firewalls to Panorama, then from Panorama to logstash, then from logstash to Sentinel. We never really run into any issue. The only issue we came across once was we started to see a log loss between Firewalls and Panorama which naturally resulted missing logs in Sentinel. This was eventually resolved by adding additional log collectors in log collector group.
Personally, I believe that having all Firewalls to send logs to Panorama and then let Panorama to send all logs to Sentinel has many benefits. For example: ease of management or ease of troubleshooting as you have only one place to look into.
On the other hand if you have many firewalls with a high log volume, then you might hit ingestion rate limitation of Panorama where Panorama would be a bottleneck (This of course depends on Panorama model and log collector design). In this case having Firewalls to send logs directly to Sentinel would be a better option.
Having both Firewalls as well as Panorama to send logs to Sentinel would be the last choice that I would preferably avoid. You will end up with log duplication.
Kind Regards
Pavel
02-17-2023 06:48 PM
Hello @ShailUpadhyay
in our case, we have been using following scenario for about 3 years:
Logs are sent from Firewalls to Panorama, then from Panorama to logstash, then from logstash to Sentinel. We never really run into any issue. The only issue we came across once was we started to see a log loss between Firewalls and Panorama which naturally resulted missing logs in Sentinel. This was eventually resolved by adding additional log collectors in log collector group.
Personally, I believe that having all Firewalls to send logs to Panorama and then let Panorama to send all logs to Sentinel has many benefits. For example: ease of management or ease of troubleshooting as you have only one place to look into.
On the other hand if you have many firewalls with a high log volume, then you might hit ingestion rate limitation of Panorama where Panorama would be a bottleneck (This of course depends on Panorama model and log collector design). In this case having Firewalls to send logs directly to Sentinel would be a better option.
Having both Firewalls as well as Panorama to send logs to Sentinel would be the last choice that I would preferably avoid. You will end up with log duplication.
Kind Regards
Pavel
02-20-2023 02:25 AM
Thank you Pavel.
So, I can assume that by integrating Panorama with Sentinel will not result in any loss / miss of logs compare to integrating individual firewalls.
02-21-2023 04:14 PM
Hello @ShailUpadhyay
thank you for reply.
It should not cause any issue. In our case we at some point were hitting the maximum log collector ingestion rate. Unless you are in the high traffic log environment you should not worry.
Kind Regards
Pavel
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
