About RobertShawver

So, at the end of the day, DNS was my big issue.  Although I could find no mention of it in the documentation - and there was a lot of documentation - going to Panorama > Managed Collectors > Select Collector > General > Primary and Secondary DNS entries were required. ... View more

@SteveCantwell  Thanks for the quick reply.  I think you might be on to something.   On the Panorama Management I have the two CG, Default and Remote.  Both have Device Log Forwarding and Collector Log Forwarding set up.  Are you saying that I should only have the Collector Log Forwarding set up?   Both the Default and Remote CG have (on the Collector Log Forwarding tab) the same syslog info on each of the tabs (system, configuration, HIP Match and so on).   So will I have just one Collector Group at the end of all this or two?   I'm not exactly sure what you mean by " I am curious if you have removed, from the Default log collector group, all configurations regarding the log forwarding of notifications".   On the Panorama Mgt under Objects > Log Forwarding I do have an entry for Log_Forward which has the check box for Panorama/Logging Service checked.   On the local FW's under Device > Server Profiles > Syslog there is no entry.  Under Device > Log Settings there is a template setting for each of the System, Configuration, User-ID and so on set up and they to have the forward method as Panorama checked.   I did talk to Palo support, but he wasn't much help to be honest.   ... View more

@SteveCantwell Hey - Thanks for the reply.   So basically I am trying to archive figure one of this document by the end of my project: https://docs.paloaltonetworks.com/panorama/9-0/panorama-admin/panorama-overview/centralized-logging-and-reporting/log-forwarding-options.html   We have two panos in an active/passive set up. PanoA and PanoB. My company wants to bring in two more Pano's strictly as log servers. So PanoA and PanoALog, PanoB and PanoBLog.  PanoA and PanoB would become strictly management.   I have done everything that you described already and now have two Collector Groups - Default and Remote.   Default has PanoA and PanoB.  Remote has PanoALog and PanoBLog.   All sounds good so far, but here is where I'm starting to either question myself or I'm having an issue.   I am slowly removing the Managed Devices from Default to Remote, however within my Syslog server it still looks like those devices are getting to the Syslog server via the original PanoA and PanoB.  In other words, none of the new loggers, PanoALog and PanoBLog appear to be talking to the syslog server.   I've added them to all the Security Rules that PanoA and PanoB were in.  Additionally, the Log Redistribution State has been at 0% for five days now on the Remote Collector Group - Default says none.   Eventually I'd like to be able to use the monitor tab of PanoA and PanoB, but have all logging done on PanoALog and PanoBLog and have them forwarding to my syslog server.   And I guess I don't really understand the difference between Device Log Forwarding and Collector Log Forwarding.   Thanks in advance for any help.   ... View more

@MickBall I don't know if there is a way for us to have a side conversation on here or not, but I'm trying to set up new loggers and am having a little trouble.  Hoping you can maybe help. ... View more