Passive firewall initiating syslog connection

[amey_13]

We've syslog configured on devices with tcp protocol on port 515. Our passive device syslog connection is breaking every 300 seconds. Can you help in understand why passive palo alto not sending keep-alive?

[BPry]

@amey_13,

What interface are you trying to make the syslog connection to? Unless it's the management interface this isn't going to work. 

[amey_13]

@BPry, It is management interface only. We are getting logs in Monitor > system saying syslog connection broken and in next second syslog connection is established, this logs are with High severity.

[BPry]

@amey_13,

Assuming that the Active and Passive firewall are not directly plugged into the same switch for management access, have you verified that it isn't actually losing connection to the syslog server? It may be that it actually is losing this connection for a second, hence why the logs are generating. 

[amey_13]

@BPry,

The firewalls (active/passive) makes a tcp connection with syslog server virtual ip configured on load balancer. On load balancer we have tcp idle timeout set to 300 seconds. The load balancer is sending reset packet to passive device after 300 seconds which breaks the connection. My query is why the passive device not sending any keep-alive to keep the tcp connection active???

Also if it sends keep-alive what is it default time, is it more then 300 seconds.

Thanks.

[BPry]

@amey_13,

To the best of my knowledge the firewall doesn't send a keep-alive, and will allow the connection to the syslog server to close if enough logs are not generated during this time frame; unlike the ESM server that actually sends a keep-alive message that you configure.