Connect Firewalls to Cortex Data Lake

Directly onboard your firewalls to Cortex™ Data Lake.
Before you start sending logs to Cortex™ Data Lake, you must generate the key that enables firewalls to securely connect to Cortex Data Lake. Onboarding keys are valid for 24 hours and you can use a single key for as many firewalls as you’d like to onboard during that 24-hour period.
After you use the Cortex Data Lake app to generate the key, copy the key and save it for future reference. Youcannot reference it again after you close out of the Cortex Data Lake app and you will need to add the key to each firewall that you want to connect to Cortex Data Lake. Generating a new key invalidates any other keys that were generated in the previous 24 hours.
Before you begin, ensure that your firewalls are running a PAN-OS version that supports direct onboarding to Cortex Data Lake.
If you’re using Panorama or Prisma™ Access
: Follow this workflow instead to connect firewalls to Cortex Data Lake and to start forwarding logs.
  1. Log in to the hub and open the Cortex Data Lake app.
  2. Select
    Firewall On-Boarding
    and
    Generate PSK
    to generate the onboarding key. Copy or save the key so that you can use it in later steps.
    app-firewall-on-boarding-psk.png
  3. Log in to the firewall that you want to connect to Cortex Data Lake.
  4. Select
    Device
    Licenses
    and confirm that the Logging Service license (now called Cortex Data Lake) is active.
    When you purchased your Cortex Data Lake license, all firewalls registered to your support account received a Cortex Data Lake license. If you don’t see the Cortex Data Lake license,
    Retrieve license keys from license server
    to manually refresh the firewall licenses.
  5. Set the
    Palo Alto Networks Services
    service route to use either the management interface or a data interface.
    • Follow these steps to use the management interface for activation. Otherwise, skip to configuring a data interface.
      1. Select
        Device
        Setup
        Services
        Global
        .Omit
        Global
        on a firewall without multiple virtual system (multi-vsys) capability.
      2. Under Services Features, click
        Service Route Configuration
        .
      3. Select
        Customize
        .
      4. Under Service, click
        Palo Alto Networks Services
        .
      5. For
        Source Interface
        , select
        MGT
        .
      6. Click
        OK
        to exit the Service Route Source dialog and click
        OK
        again to exit Service Route Configuration.
    After activation, you can configure a different interface to forward logs to Cortex Data Lake. For details, see how to Start Sending Logs to Cortex Data Lake.
    • If you chose not to use the management interface for activation, use a data interface by configuring destination service routes for the following FQDNs:
      • api.paloaltonetworks.com
      • apitrusted.paloaltonetworks.com
      • lic.lc.prod.us.cs.paloaltonetworks.com
      1. Select
        Device
        Setup
        Services
        Global
        .Omit
        Global
        on a firewall without multiple virtual system (multi-vsys) capability.
      2. Under Services Features, click
        Service Route Configuration
        .
      3. Select
        Customize
        .
      4. Under Service, select the following:
        • Palo Alto Networks Services
        • CRL status
        • DNS
        • HTTP
        • NTP
      5. Set Selected Service Routes
        .
      6. Select the
        Source Interface
        you want to use for activation and then select a
        Source Address
        from that interface.
        key-set-routes.png
      7. Click
        OK
        .
      8. Select
        Destination
        .
      9. Add
        a destination.
      10. Enter any of the FQDNs above as
        Destination
        .
        key-destination-fqdn.png
      11. Select the same
        Source Interface
        and
        Source Address
        that you selected for activation.
      12. Click
        OK
        .
      13. Add
        two more destinations for the same interface using the remaining two FQDNs.
        key-destinations.png
      14. Click
        OK
        to exit Service Route Configuration.
  6. Set up the connection to Cortex Data Lake and check connection status:
    1. Select
      Device
      Setup
      Management
      and find the
      Logging Service
      settings (Cortex Data Lake used to be called Logging Service).
    2. (
      Important
      ) Before you populate any other settings, find the
      Onboard to Cloud
      option. Click
      Connect
      and enter the
      PSK
      (onboarding key) you generated in the Cortex Data Lake app. Then click
      Connect
      again.
      After you connect, you should see a pop-up dialog that confirms that the firewall is equipped with the certificate it needs to authenticate to Cortex Data Lake. You can also check the
      Task Manager
      to confirm that the firewall successfully authenticated to Cortex Data Lake.
    3. Enable f
      to connect the firewall to Cortex Data Lake. If you want the firewall to collect data that increases visibility for Palo Alto Networks applications, like Cortex XDR, you can also
      Enable Enhanced Application Logging
      .
      Cortex Data Lake logging doesn’t start until after you’ve specified the log types you want to forward. Complete these steps to make sure that the firewall is connected to Cortex Data Lake and then Start Sending Logs to Cortex Data Lake.
      Do not
      Enable Duplicate Logging
      . This option applies only to Panorama-managed firewalls.
    4. Select the geographic
      Region
      of the Cortex Data Lake instance to which youwant to forward logs. This is the region you chose when you activated Cortex Data Lake.
    5. Show Status
      to check
      Logging Service Status
      (Cortex Data Lake). The status for License, Certificate, and Customer Info should be green.
      There is a known issue where device connectivity does not display a green status indicator even when the firewall is successfully connected to Cortex Data Lake.
  7. The firewall is now connected to Cortex Data Lake but it is not, yet, forwarding logs. Follow these steps to start sending logs and to best secure traffic between the firewall and Cortex Data Lake.

Recommended For You