Can't see firewall logs in Panorama

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Can't see firewall logs in Panorama

L0 Member

Hi, 

New to all things Palo Alto after coming from Cisco ASA and Firepower.  

 

I've been ask to set 2 Palo alto Firewall in HA, this has been successful.  Added them to Panorama which appear to be successful and configure the Palo Altos to send logs to Panorama, on the Palo Alto under objects>Log forwarding> Created a profile and ticked the 'Panorama' Box. 

I was surprised it was that easy till I checked on Panorama Monitor>Logs>Traffic  and there was nothing there. what have i misssed ?

 

This is the first step as the final Idea is to then output Panorama to QRadar. 

 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hello @PaulTowns

 

you should add log forwarding profile to all 78 policies. If you create log forwarding profile with name "default" it will be automatically added to every new security policy you create. Here is a link in documentation for reference: Configure Log Forwarding.

 

For all existing security policies you will have to add log forwarding profile. Starting with PAN-OS 10.2 you can add log forwarding profile to all policies in bulk. Here is a link for reference: How to Add Log Forwarding Profiles in All Security Policies.

 

Lastly, predefined policies: “intrazone-default” or “interzone-default” have to be overridden to make changes to add log forwarding profile. Link for reference: What are Universal, Intrazone and Interzone Rules 

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

View solution in original post

4 REPLIES 4

Cyber Elite
Cyber Elite

Hi @PaulTowns 

Can you check if log forwarding profile is attached to the security policies ?

You can refer steps given here for the configuration.

 

Hope it helps!

M

L0 Member

In that it asks to setup Options for Log settings, does this mean I need to add this to all the policies  on the Firewall? This firewall has 78 policies. or do I simply create a policy for traffic to Panorama and add it to that one so all logs are sent?

Cyber Elite
Cyber Elite

Hello @PaulTowns

 

you should add log forwarding profile to all 78 policies. If you create log forwarding profile with name "default" it will be automatically added to every new security policy you create. Here is a link in documentation for reference: Configure Log Forwarding.

 

For all existing security policies you will have to add log forwarding profile. Starting with PAN-OS 10.2 you can add log forwarding profile to all policies in bulk. Here is a link for reference: How to Add Log Forwarding Profiles in All Security Policies.

 

Lastly, predefined policies: “intrazone-default” or “interzone-default” have to be overridden to make changes to add log forwarding profile. Link for reference: What are Universal, Intrazone and Interzone Rules 

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Thank you sir for the link, please mark it as a solution.

  • 1 accepted solution
  • 932 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!