Can't see firewall logs in Panorama

[PaulTowns]

Hi, 

New to all things Palo Alto after coming from Cisco ASA and Firepower.  

I've been ask to set 2 Palo alto Firewall in HA, this has been successful.  Added them to Panorama which appear to be successful and configure the Palo Altos to send logs to Panorama, on the Palo Alto under objects>Log forwarding> Created a profile and ticked the 'Panorama' Box. 

I was surprised it was that easy till I checked on Panorama Monitor>Logs>Traffic  and there was nothing there. what have i misssed ?

This is the first step as the final Idea is to then output Panorama to QRadar. 

[SutareMayur]

Hi @PaulTowns 

Can you check if log forwarding profile is attached to the security policies ?

You can refer steps given here for the configuration.

Hope it helps!

[PaulTowns]

In that it asks to setup Options for Log settings, does this mean I need to add this to all the policies  on the Firewall? This firewall has 78 policies. or do I simply create a policy for traffic to Panorama and add it to that one so all logs are sent?

[PavelK · Accepted solution]

Hello @PaulTowns

you should add log forwarding profile to all 78 policies. If you create log forwarding profile with name "default" it will be automatically added to every new security policy you create. Here is a link in documentation for reference: Configure Log Forwarding.

For all existing security policies you will have to add log forwarding profile. Starting with PAN-OS 10.2 you can add log forwarding profile to all policies in bulk. Here is a link for reference: How to Add Log Forwarding Profiles in All Security Policies.

Lastly, predefined policies: “intrazone-default” or “interzone-default” have to be overridden to make changes to add log forwarding profile. Link for reference: What are Universal, Intrazone and Interzone Rules 

Kind Regards

Pavel

[CourtneyBoggs]

Thank you sir for the link, please mark it as a solution.