Panorama centralised syslog forwarding ?

[Bart_Jocque]

Is the following scenario configurable :

FIREWALLS--->panoramalogging--->PANORAMA--->syslog--->SYSLOGSERVER

Usually enterprises have a Central Firewall Management infra (= Panorama ) and a SIEM infra.

But we want to avoid that individual firewalls needs to send out twice the same logs.

[dburns · Accepted solution]

Currently there is no feature for panorama to forward traffic logs to the syslog server. The traffic logs have to be configured to forward logs to the syslog server via log forwarding profile.

Dominic

[chrisp]

Just wanted to clarify the response to this question. The log forwarding profiles would have to be created on each Firewall to send syslogs to the SIEM in addition to sending logs to Panorama? There is no way to use Panorama as a central point for forwarding all the firewall logs to a SIEM?

Thanks,

Chris

[mschuricht]

Chris,

You could create the log forwarding profile in Panorama and push it to the devices. Then you can use the log forwarding profile on rules on the device or in Panorama pushed rules so the profile is centrally managed.

There is no way to use Panorama as the syslog forwarding point for traffic logs.

[Sr_Sealion]

Can we get this functionality added in a future release of PANORAMA?

[mschuricht]

Please work with your SE to file a feature request.

[junaid.khan]

Just wondering if this feature request was ever implemented. We are also in the same boat. We got Panorama 4.1.2 and Firewall devices, They all sending traffic/threat/datafiltering and other logs to Panorama, We would like to see if the same logs could be forwarded to SIEM.

Appreciate the answer.

Thanks

Junaid

[mschuricht]

Unfortunately this FR has not been implemented yet.

[mikand]

But is it on the roadmap or does all customers need to contact their sales rep for this to happen?

[cfnavarra]

We requested this feature to our sales rep a year ago.

[mschuricht]

This request has been around for quite some time. We analyze feature request (FR), strategic requirements, and enhancement ideas before each release. We then propose a set of reqs for a release and review with engr. Priorities, resource capacity, and difficulty are used to thin the list of reqs to what ends up being delivered.

This particular req has made it to the short list a couple time and never through the final phase where it would end up in Panorama. We are continuing to push for inclusion since it is both requested by customers frequently and strategic.

Please ask your SE for more details about the FR process if you have more questions.

[broadleyn]

Kind of makes me wonder what the point of Panorama is, given that we don't use shared rules. Might be one for us to drop maintenance for actually. We get no value from our deployment of this service.

I'll speak to our account rep regarding the future of this product.

[mschuricht]

Panorama is essential when you have many firewalls to manage and administering each device independently no longer scales. We see customers beginning to use Panorama for centralized configuration management when they have 6-10 devices. These customers utilize it for aggregate deployment visibility, configuration management, and maintenance.

Some smaller customers with less devices will use Panorama to provide centralized visibility over their devices though log forwarding because they like our reporting, log viewing, and ACC functionality. These customers will also use it for maintenance to push SW, content, and client updates from Panorama centrally. In this case it is less about centralized configuration management as you pointed out for your enterprise currently.

Syslog collectors are important for many customers and can augment the capabilities of Palo Alto Networks devices as well as Panorama. If the Syslog forwarding from Panorama were to be implemented in a future release, we hope Panorama would be utilized for more than just Syslog relay functionality.

[broadleyn]

Thanks for the clarification, Mike. I'm still struggling to see value in Panorama in terms of administrating multiple devices personally - the pre/post policy rules are clunky and we haven't found the Threat/AV updates to be reliable, so the main selling points for us was the unified log. But since we have a SIEM tool, Solarwinds Orion, Panorama and Tufin SecureTrack all demanding syslog from the firewalls in order to provide various functionality, we have the firewalls generating between 3000 and 10,000 sessions of syslog continually, hammering the management plane and swamping the service-route NIC.

It shouldn't be the firewall's job to send syslog to multiple sources - it's the management device's job to do so. That Panorama can't do this reduces it to a minor convenience tool. In fact, since our main firewalls are active/standby, the only time Panorama is accessed is when we have a failover event, which is to say, almost never.

As I say, I'll raise this with our account manager, ditch Panorama from our maintenance contact next cycle and if it's ever developed in a more useful direction, we'll revisit the decision.

[stoltze]

Hi,

Seems to remember that PA talked about syslog forwarding from Panorama to syslog server, including logs from firewalls at the SE Tech Update in Helsinki a few months ago..

But I can't find anything about in Panorama 5.1..?

Has this still not been implemented...?

Regards,

Niels Stoltze