TLS syslog to a cloud based SIEM

Reply
Highlighted
L1 Bithead

TLS syslog to a cloud based SIEM

Running software version  8.1.10 on this PA firewall.


I have the TLS syslog server profile setup in Configuration type logs and that works (getting config logs).
Then I setup this log forwarder profile that has both TLS syslog and UDP syslog server profiles.
When using adding logging for each line of policy to log on session close with the aforementioned log forwarding profile. Only my UDP syslog collector is getting logs.

Anyone else have any challenges getting this working?

Community Team Member

Hi @ryupapa ,

 

I'm assuming that the TLS syslog server and profile is setup correctly seeing that it's getting the config type logs just fine.

 

You should be able to configure upto 4 servers in a single profile... I don't see why it wouldn't work.

Does it work if you add ONLY the TLS syslog server into the new profile ? Or is it a problem only when you add multiple servers to the profile ?

 

Cheers,

-Kiwi.

 
Highlighted
L1 Bithead

Originally I had only the TLS syslog server. For fun I made a new log-profile. Still is not working. 

I was toying with the idea that Palo just doesn't want to overburden themselves with TLS syslog for traffic logs. Doesn't make sense since it is documented.....

Tags (1)
Highlighted
L1 Bithead

Looking at packet captures...

the firewall establishes 3 way handshake with the SIEM for tls syslog. Waits for 106 seconds later then sends the client hello, and milliseconds after sends a FIN-ACK to the SEIM before getting the ack back the siem.

Why does it wait 106 seconds before sending the client hellp? very strange....

 

Again tls syslog for config and system logs work fine with the same siem.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!