IoT Devices in Panorama

[Martin_Urbanski]

Hello LiveCommunity Team,

we are using a PA-5410 Firewall with IoT Security Feature (Does not Require Data Lake). The firewall is managed by Panorama. SLS is enabled on both systems (fw & Panorama).

On Panorama --> Setup --> Management --> PAN-OS Edge Service Settings --> Enable IoT Device Context Cloud Service is also activated.

On the fw I see under Monitor --> IoT Devices a lot of discovered devices. That information is not getting redistributed to the Panorama. 

Does anyone have an idea, why I don't see the IoT devices on Panorama?

Best Regards,

Martin

[PavelK]

Hello @Martin_Urbanski

thanks for posting!

To be able to get logs in Strata Logging Service as well as in Panorama you will have to enable in Firewall: "Enable Duplicate Logging (Cloud and On-Premise)". Here is the reference: Forward Logs to Strata Logging Service. Once this is enabled you should be able to see discovered devices under: Monitor > IoT Devices in Panorama.

Kind Regards

Pavel 

[Martin_Urbanski]

Hello @PavelK ,

thank you for your answer. 

Duplicate Logging ist activated already. I receive other logs, like traffic or system logs from fw on the panorama.

Best Regards,

Martin

[PavelK]

Hello @Martin_Urbanski

thank you for reply.

I was wrong in my previous reply. Duplicate logging does not take effect for IoT logs. It is using different ingestion pipeline. Here is the quote from documentation: "Panorama streams logs through cloud logging for Device Security to ingest, even if you have a Doesn't Require Data Lake license." (Reference: Prepare Your Firewall for Device Security ).

Could you confirm that you can see discovered devices in SCM under: Insights > SECURITY > Device Security? Could you confirm your Panorama has internet connectivity and valid device certificate?

Kind Regards

Pavel 

I was wrong in me previous reply.