Question about logging and Panorama

[TimGrossner]

Is it possible to have both a Panorama server receiving logs from the gateways AND a syslog server receiving them at the same time? Any examples?

I also believe I heard that there is potential to have the feature in an upcoming rev of Panorama forwarding logs to other destinations, like another Panorama or Syslog server. Still in the works?

[shasnain]

Hi,

You can configure the Firewall with a syslog server profile and forward the logs to the syslog server and simultaneously enabled logging to the Panorama also. Panorama cannot be configured to forward the logs from it self to any other syslogs server.

Thanks,

Syed R Hasnain

[TimGrossner]

If you do the scenario like you specify, how do you handle logging of url filtering or rule hits? It only seems to be able to select 1 logging destination in the rule logging option.

[shasnain · Accepted solution]

You will need to create a log-forwarding profile in the objects tab and select Panorama and Syslog under that and then associate that profile with the policy with URL filtering profile enabled with alerts or block actions.

Thanks,

Syed R Hasnain

[TimGrossner]

Perfect. Thank you!