Monitoring Palo Alto PanOS Firewall Devices

Overview

TOS Aurora monitors Palo Alto PanOS firewall devices for policy revision changes. For TOS Aurora to show revision accountability and show rule and object usage, you must also configure the device to send syslogs.

To see which TOS features are supported for your device, review the feature support table.

Prerequisites

Create a user with the Superuser admin role for the Palo Alto PanOS firewall device. For PanOS 4.1 and higher you can also use a Superuser (read-only) user. TOS Aurora does not write anything to the Palo Alto device for either user role.

Recommendations

TOS Aurora and the monitored devices must be synchronized with the correct date and time, either manually or automatically. We recommend that you also configure the devices to resolve DNS queries.
Object usage analysis requires plenty of free disk space (depending on the number of gateways and the amount of traffic logs generated). If disk space is limited, you can configure TOS Aurora to limit the number of days that data is kept.
Enable TOS Aurora administrative alerts, which notify you if there is low disk space on the server. When disk utilization exceeds 90% in the partition that has the database, TOS Aurora sends an alert.
Clusters are only fully supported when managed by a Panorama device. When adding standalone PanOS clusters without a Panorama, add the standby member with a different IP address (if possible), and disable usage analysis collection and topology. This will prevent the standby member from appearing on the interactive map, and ensure that routing is correct.

Add a Device

Select Palo Alto > PanOS:
Configure the device settings:
- Name for Display
- Domain: Available only if you have configured your system for managing multi-domains and All Domains is currently selected. Select the domain to which to add the device. The Domain can only be entered when adding a device; to change the Domain, you must migrate the device.
- Get revisions from: One of the following:
  - IP Address: Revisions are retrieved automatically
  - Offline File: (If available) Revisions are manually uploaded to TOS Aurora for Offline Analysis
    This option is disabled for Panorama devices.
- ST server: In a distributed deployment, select which TOS Aurora cluster monitors this device (not shown in image)
- To enable adding and monitoring Virtual Systems, select This device has Virtual Systems configured. If selected, Usage Analysis is moved to the Import Virtual Systems step.
Usage Analysis
- Collect traffic logs for rule usage analysis is necessary for Rule Usage reports.
- Collect counters for object usage analysis enables Rule Usage reports to include per-object usage information.
  - Collect traffic logs for object usage analysis is necessary for reporting on unused objects and services in Rule Usage Reports.
Topology
- Enable Topology: Collects routing information for building the network Interactive Map.
  Topology options for Advanced management mode are configured when you import managed devices.
- If the device uses dynamic addressing (such as DHCP) or dynamic routing protocols (such as OSPF), also select Collect dynamic topology information. TOS Aurora always collects the interface information with static routes and IP addresses when it receives a policy.
Click Next.
Configure the TOS Aurora connection to the Palo Alto PanOS firewall device, according to the parameters required by the device.

Enter the authentication details needed to connect to the Palo Alto PanOS firewall device.

To use default settings (recommended in most cases), leave the Port number blank.
Click Next.
The Monitoring Settings page appears:
- To use timing settings from the Timing page, select Default. Otherwise, select Custom, Custom settings, and configure the Polling frequency: How often TOS Aurora fetches the configuration from each device.
If you select 1 day, you can then select the exact time (hour and minute) for the daily polling.
Save the configuration.

The Palo Alto PanOS firewall device now appears in the Monitored Devices list.

For TOS Aurora to show revision accountability and show rule and object usage, you must also configure the device to send syslogs.

Configure a Monitored Device

After you add a device, further configuration options are available.

Options vary depending on your environment.

Edit configuration: Use the wizard to modify selected device settings. See Add a Device in this topic.
Delete this device: Type yes to confirm that you want to delete the device.
Migrate (ST servers): Available in distributed deployments. Select the server where the device will be monitored and click Migrate.
Migrate (Domains): Available in multi-domain deployments. Select the domain where the device will be monitored and click Migrate.

How Do I Get Here?

SecureTrack > Monitoring > Manage Devices