configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

[akilgolandaz]

I need help to configure log forwarding on firewall to Panorama but I dont want to add the firewalls to Panorama

configuration to get traffic logs from a Palo Alto firewall into Panorama without directly adding it as a managed device

[reaper]

The firewall needs to be connected to panorama to receive the correct log collector configuration.

The log collector get's a list of firewalls that are allowed to send log to it from the managed devices, and managed devices are instructed which collector is their primary log forwarding target etc.

This cannot be achieved without attaching a firewall to panorama managed devices (you are not required to push any configuration onto the managed firewall, if that is your worry)

[akilgolandaz]

Thanks Reaper, due to some restriction in our environment we are not allowed to add few firewalls to Panorama as managed devices.

I know is not a normal practice and its an exceptional configuration we need to achieve the goal. 

[vsurresh]

You can do it but you still need to add the firewall as a managed device but don't add it to any templates or device-groups. I've done this recently for the same purpose of getting the logs into Panorama without managing it.

[akilgolandaz]

Hi Vsurresh,
thank you for your response. 

So to accomplish the requirement, I need to add the firewall under Panorama > Managed devices 

But I should not add the firewall in any template or device groups

Correct !

[vsurresh]

I can't remember exactly what I did but these are the steps I took looking at my notes.

• Add both Panorama IPs to the firewall and leave all other settings at default
• Add the firewall serials to Panorama
• Add the firewall to the log collector group
• Create a log forwarding profile called ‘default’ which forwards all the traffic logs to Panorama.
• Add the log forwarding profile to all the security rules
• A firewall is not added to any device groups or templates on Panorama

[reaper]

indeed, the firewall does not need to be member of a device group or template, but it does need to be in 'managed devices' to get the colector configuration sent to it

[akilgolandaz]

Thank you Vsurresh

[akilgolandaz]

Got it Tom Piens