PANOS Autotag Workflow

[yctan]

I understand we can now add action to dynamic update source / destination IP to our DAG by log forwarding profile.

Can i create 2 traffic profile, 1 for forwardining to syslog another 1 to update the DAG?

How does it work.

Thanks

[reaper]

you can only assign 1 log forwarding profile per security policy, but you can assign multiple "methods" and "actions" per profile

[yctan]

If i have a security policy that needs to forward my full traffic logs to a syslog server and yet i need to have a specific condition of source ip using destination port 5007 to be auto tag to a DAG.

Is this achiveable?

Thanks

[reaper]

you'll need to create 2 security policies, as the filter applied to a log forwarding profile applies to the whole profile

you may want to reach out to your local sales team and have a feature request created to split up filtering for forwarding and tagging within the same profile