Adding Palo Alto PanOS Firewall Devices

TOS Aurora monitors Palo Alto PanOS firewall devices for policy revision changes. For TOS Aurora to show revision accountability and show rule and object usage, you must also configure the device to send syslogs. To help you organize the information for your devices, you can use the device information worksheet. To see which TOS features are supported for your device, review the feature support table.

TOS Aurora and the monitored devices must be synchronized with the correct date and time, either manually or automatically. We recommend that you also configure the devices to resolve DNS queries.

Prerequisites

Monitoring: Create a user with the Superuser admin role for the Palo Alto PanOS firewall device. For PanOS 4.1 and higher you can also use a Superuser (read-only) user. TOS Aurora does not write anything to the Palo Alto device for either user role.

Monitor a Palo Alto PanOS Firewall Device

  1. In TOS Aurora, go to Monitoring > Manage Devices.

  2. Select the appropriate device type:

    Add Devices

    Add Palo Alto

  3. Configure the device settings:

    New Palo Alto Stage 1

    • Name for Display

    • Domain: Available only if you have configured your system for managing multi-domains and All Domains is currently selected. Select the domain to which to add the device. The Domain can only be entered when adding a device; to change the Domain, you must migrate the device.

    • Get revisions from: One of the following:

      • IP Address: Revisions are retrieved automatically
      • Offline File: (If available) Revisions are manually uploaded to TOS Aurora for Offline Analysis

        This option is disabled for Panorama devices.

    • ST server: In a distributed deployment, select which TOS Aurora cluster monitors this device (not shown in image)

    • To enable adding and monitoring Virtual Systems, select This device has Virtual Systems configured. If selected, Usage Analysis is moved to the Import Virtual Systems step.

    Usage Analysis

    • Collect traffic logs for rule usage analysis is necessary for Rule Usage reports.

    • Collect counters for object usage analysis enables Rule Usage reports to include per-object usage information.

      • Collect traffic logs for object usage analysis is necessary for reporting on unused objects and services in Rule Usage Reports.

      Object usage analysis requires plenty of free disk space (depending on the number of gateways and the amount of traffic logs generated). If disk space is limited, you can configure TOS Aurora to limit the number of days that data is kept.

      We recommend that you enable TOS Aurora administrative alerts, which notify you if there is low disk space on the server. When disk utilization exceeds 90% in the partition that has the database, TOS Aurora sends an alert.

    Topology

    • Enable Topology: Collects routing information for building the network Interactive Map.
      Topology options for Advanced management mode are configured when you import managed devices.
    • If the device uses dynamic addressing (such as DHCP) or dynamic routing protocols (such as OSPF), also select Collect dynamic topology information. TOS Aurora always collects the interface information with static routes and IP addresses when it receives a policy.
  4. Click Next.

  5. Configure the TOS Aurora connection to the Palo Alto PanOS firewall device, according to the parameters required by the device.

    New Palo Alto stage 2

    Enter the authentication details needed to connect to the Palo Alto PanOS firewall device.

    To use default settings (recommended in most cases), leave the Port number blank.

  6. Click Next.

  7. The Monitoring Settings page appears:

    New Palo Alto stage 3

    • To use timing settings from the Timing page, select Default. Otherwise, select Custom, Custom settings, and configure the Polling frequency: How often TOS Aurora fetches the configuration from each device.

    If you select 1 day, you can then select the exact time (hour and minute) for the daily polling.

  8. Save the configuration.

    The Palo Alto PanOS firewall device now appears in the Monitored Devices tree.

  9. To manually add Virtual Systems to your device, wait for a revision to be received from the device (you can see the revision in Compare view). This may take several minutes. Then, add the Virtual Systems:

    1. In the Monitored Devices tree, select the device.

    2. Click Import Virtual Systems (only enabled for Manual Import):

      Import Palo Alto Virtual Systems

    3. Select all the Virtual Systems to be added.

      If the option to collect rule and object usage statistics for virtual contexts is available, it is enabled.

      If you do not want to collect these statistics, clear the options before you import the virtual contexts.

    4. Click Save.

For TOS Aurora to show revision accountability and show rule and object usage, you must also configure the device to send syslogs.

How Do I Get Here?

In TOS Aurora, go to Monitoring > Manage Devices.