Configure cluster send Log to Panorama that not manage it

[Chris80]

Hello,

I have a Panorama that manage several clusters and I have one remote cluster that isn't managed but I would like to have the cluster log on Panorama just to have only 1 point to analyze the logs. 
It's possible to configure a unmanaged cluster to send the log to Panorama?

[JayGolf]

Hi @Chris80 ,

You can configure an unmanaged fw to forward logs to your Panorama by creating a syslog server profile and entering your Panoramas management IP as the syslog server IP.

[Chris80]

Hi @JayGolf,

I don't have to change the Panorama conf to allow/accept the syslog flows coming from the unmanaged cluster?

Alternative scenario:

Instead of create a syslog on cluster it's possible to add the cluster under Panorama but not configure device-group and template and add only the conf that allow the cluster to send log to Panorama?


Chris

[JayGolf]

Hi @Chris80 ,

To clarify, it is technically possible to forward logs to the Panorama management IP using a syslog profile, but those logs won't show up in Panoramas monitor tab unless the device is licensed itself and is managed by Panorama. 

I would go ahead and add the firewall as a managed device and proceed with your alternative scenario.

[Chris80]

Hello,
So I should add the cluster as a managed device but not add it to any Template  or Device-group to avoid cluster configuration change coming from Panorama, then configure syslog on the local conf of the cluster. After this two steps I will able to see the log on Panorama monitor tab as usual right?

[PavelK]

Hello @Chris80

you will have to perform below steps.

1.)

Register Firewall to Panorama (Add Firewall's S/N + Authentication key).

2.)

Theoretically, it is not necessary to add Firewall to Device Group to get logs only, however I recall memory that logs did not show up until I associated Firewall with Device Group. Please test it first by not associating Firewall with Device Group. If logs do not show up after completing all the steps, please add Firewall to Device Group to see logs show up.

3.)

Add Firewall to log collector group by navigating to: Panorama > Collector Groups > [Log Collector Name] > Device Log Forwarding > Log > Forwarding Preference.

4.)

Commit configuration to Panorama and to log collector. If you do not push configuration to log collector group logs will not show up. To see the logs you do not have to push Device Group configuration, but if you have assigned Firewall to for example dummy Device Group with no actual configuration in it, the Firewall will be reporting out of sync status, however this should not prevent Firewall from sending logs to Panorama.

5.)

On Firewall side, in log forwarding profile select log Forwarding Method "Panorama" checkbox.

After completing all steps you should see Firewall logs coming without having Panorama managing Firewall configuration. There are a few things to keep in mind. If your Firewall and Panorama are using different Time/Time Zone logs might not show up in Panorama's GUI. Ideally you should sync time with the same NTP server.

Kind Regards

Pavel