Panorama 9.x, 10.x, or 11.x Log Forwarding and Accountability

This topic is intended for TOS Administrators.

Overview

For general information about sending syslogs, see Sending Additional Information using Syslog.

There are two supported methods for forwarding traffic logs to TOS:

• The managed firewalls forward traffic logs directly to TOS.

  Use this method when the Panorama device is in Management only, or Legacy mode.

• The Panorama forwards the traffic logs from the managed firewalls to TOS.

  Use this method when the Panorama device is in Panorama mode.

Each method requires that accountability be enabled in a different location. Accountability is required to ensure that TOS can see which user made which changes on each revision.

For more information, see the Palo Alto Networks technical documentation site:

• For PanOS 9: Configure Log Forwarding and Device > Server Profiles > Syslog

• For PanOS 10: Configure Log Forwarding and Device > Server Profiles > Syslog

• For PanOS 11: Configure Log Forwarding and Device > Server Profiles > Syslog

Forward traffic logs from firewall to TOS

1. Log into the firewall device.

2. In the Device tab, create a syslog server profile with the following information:

   • Syslog server: TOS syslog VIP

   • Transport: UDP

   • Port: 514

   • Format: BSD

   • Facility: LOG_User

3. Modify a log forwarding profile to point to the syslog profile created in the previous step..

1. In the Objects tab, navigate to Log Forwarding.

2. Click the link of the log forwarding profile.

The Log Forwarding Profile dialog box appears.

3. Click a log forwarding profile match list link.

The Log Forwarding Profile Match List dialog box appears.

4. Select Panorama/Logging Service.

5. In the Syslog area, select an existing syslog profile or click Add to create a syslog profile.

6. Click OK and OK.

4. Add SecureTrack to the syslog server profile to ensure that the Panorama forwards the logs to SecureTrack.

   1. In the Devices tab, navigate to Syslog (under Server Profiles).

   2. Click the link of the syslog server profile to which you want to add SecureTrack.

   The Syslog Server Profile dialog box appears.

   3. Click the Add button, and enter the details of the SecureTrack server.

      • Name: The name of the SecureTrack server.

      • Syslog Server: The IP address of the syslog server.

      • Facility: LOG_LOCAL7 facility .

5. Click OK.

Enable accountability

1. In the Panorama tab, navigate to Server Profiles > Syslog.

2. Add a new syslog server profile.

   1. From the bottom of the screen, select +Add.

      The Syslog Server Profile dialog box appears.

   2. Enter a name for your syslog server profile.

   3. +Add at least one syslog server. The syslog server must direct to the appropriate TOS destination described in Sending Additional Information via Syslog.

3. In the Panorama tab, navigate to Log Settings.

4. In the Configuration table, click the Add button to configure a new log.

The Log Settings - Configuration dialog box appears.

5. In the Forward Method table:

   1. Select Syslog

   2. Click the Add button, and select the Syslog Server Profile you added in Step 2.

6. Click OK.