Forward Traps to an SNMP Manager (Strata Cloud Manager)

1. Enable the SNMP manager to interpret the traps it receives.

   Load the Supported MIBs for Palo Alto Networks firewalls and, if necessary, compile them. For the specific steps, refer to the documentation of your SNMP manager.
2. Configure an SNMP Trap server profile.

   The profile defines how the firewall accesses the SNMP managers (trap servers). You can define up to four SNMP managers for each profile.

   Optionally, configure separate SNMP Trap server profiles for different log types, severity levels, and WildFire verdicts.
3. Log in to Strata Cloud Manager.
4. Select ManageConfigurationNGFW and Prisma AccessObjectsLog ForwardingSNMP Server Profile.
5. Click Add SNMP Server and enter a Name for the profile.

   1. Select the SNMP Version and configure the authentication values as follows. For version details, see SNMP Monitoring and Traps.

      • V2c—For each server, click Add and enter the server Name, IP address (SNMP Manager), and Community String. The community string identifies a community of SNMP managers and monitored devices, and serves as a password to authenticate the community members to each other.
        As a best practice, don’t use the default community string public; it’s well known and therefore not secure.
      • V3—For each server, click Add and enter the server Name, IP address (SNMP Manager), SNMP User account (this must match a username defined in the SNMP manager), EngineID used to uniquely identify the firewall (you can leave the field blank to use the firewall serial number), authentication password (Auth Password) used to authenticate to the server, privacy password (Priv Password) used to encrypt SNMP messages to the server, (Authentication Protocol), and (Privacy Protocol).
        When selecting a combination of Authentication Protocol and Privacy Protocol, ensure that the Authentication Protocol is equal to or more advanced than the Privacy Protocol.

        For example, SHA-256 and AES are compatible, however SHA and AES-192 are not.
   2. Click Save to save the server profile.
6. Configure log forwarding.

   1. Configure the destinations of Traffic, Threat, and WildFire traps:

      1. Create a Log Forwarding profile. For each log type and each severity level or WildFire verdict, select the SNMP Trap server profile.
      2. Assign the Log Forwarding profile to policy rules and network zones. The rules and zones will trigger trap generation and forwarding.
   2. Configure the destinations for System, Configuration, User-ID, HIP Match, and Correlation logs. For each log (trap) type and severity level, select the SNMP Trap server profile.
   3. Push Config to push your configuration changes.
7. Monitor the traps in an SNMP manager.

   Refer to the documentation of your SNMP manager.

   When monitoring traps related to firewall interfaces, you must match the interface indexes in the SNMP manager with interface names in the firewall web interface. For details, see Firewall Interface Identifiers in SNMP Managers and NetFlow Collectors.