10.1 or Later

On your firewalls, allow access to the ports and FQDNs required to connect to
Strata Logging Service
. If you are using a proxy server, allow the same ports and FQDNs on the server without SSL decryption.
Ensure that you are not decrypting traffic to
Strata Logging Service
.
(
Optional
) To configure firewall to connect to
Strata Logging Service
through a proxy server, select
Device
Setup
Services
Use proxy to send logs to
Strata Logging Service
.
By default, the management interface is used to forward logs to
Strata Logging Service
. If you choose not to use the management interface, use a data interface by configuring destination service routes for the following FQDNs: api.paloaltonetworks.com, apitrusted.paloaltonetworks.com, lic.lc.prod.us.cs.paloaltonetworks.com,certificatetrusted.paloaltonetworks.com, certificate.paloaltonetworks.com.
Select
Device
Setup
Services
Global
.
Global
on a firewall without multiple virtual system (multi-vsys) capability.
Under Services Features, click
Service Route Configuration
.
Select
Customize
.
Under Service, select the following:
Palo Alto Networks Services
CRL status
DNS
HTTP
NTP
Set
Selected Service Routes
.
Select the
Source Interface
you want to use for activation and then select a
Source Address
from that interface and click
OK
.

Select
Destination
and
Add
a destination.
Enter any of the FQDNs above as
Destination
.

Select the same
Source Interface
and
Source Address
that you selected for activation and click
OK
.
Add
two more destinations for the same interface using the remaining two FQDNs.

Click
OK
again to exit Service Route Configuration.
Update the access rules required to connect to
Strata Logging Service
for the new interface IP address.
Configure NTP so that the firewall stays in sync with
Strata Logging Service
. Ignore this step if you have enabled proxy configuration:
On firewall, click
Device
Setup
Services

and set the
NTP Server Address
. For example:
pool.ntp.org
.
Install a device certificate on the firewalls that you want to connect to
Strata Logging Service
.
If this is your first time installing a device certificate, you must delete the
Strata Logging Service
key and re-fetch it by issuing the following commands:
> delete license key <CDL_License_Key>
> request license fetch
This is only required the first time that you install the device certificate.
Onboard the firewalls to a
Strata Logging Service
instance.
Ignore this step if you don't have a
Strata Logging Service
license and want to send logs to Cortex XDR only.
Log in to the hub and open the
Strata Logging Service
app to the instance to which you are onboarding.
Select
Inventory
Firewalls
Add
.
Select
New
and
Next
.
Select the firewalls to connect to
Strata Logging Service
and choose whether
Strata Logging Service
will store or only ingest their data.
Submit
your choices.
Select
Device
Licenses
and confirm that the
Strata Logging Service
license is active. Ensure that you have subscribed to a valid support license of
Strata Logging Service
(90 days software warranty is not counted as a valid support license).
When you purchased your
Strata Logging Service
license, all firewalls registered to your support account received a
Strata Logging Service
license. If you don’t see the
Strata Logging Service
license,
Retrieve license keys from license server
to manually refresh the firewall licenses.
Set up the connection to
Strata Logging Service
and check connection status:
Select
Device
Setup
Management
and find the
Logging Service
settings.
Enable Logging Service
to connect the firewall to
Strata Logging Service
. If you want the firewall to collect data that increases visibility for Palo Alto Networks applications, like Cortex XDR, you can also
Enable Enhanced Application Logging
.
Strata Logging Service
logging doesn’t start until after you’ve specified the log types you want to forward. Complete these steps and then
start sending logs to
Strata Logging Service
.
Do not
Enable Duplicate Logging
. This option applies only to Panorama-managed firewalls.
Commit and push the config to firewalls.
Show Status
to check
Logging Service Status
(
Strata Logging Service
). The status for License, Certificate, and Customer Info should be green.
You can also use this command to check the certificate status along with other details related to
Strata Logging Service
:
request logging-service-forwarding status
The firewall is now connected to
Strata Logging Service
but is not yet forwarding logs. Follow these steps to start sending logs and to best secure traffic between the firewall and
Strata Logging Service
.