>
    Strata Copilot
    Configure Policies for Log Forwarding
    Focus
    Download PDF
    Focus
    1. Home
    2. Device Security
    3. Getting Started
    4. Prepare Your Firewall for Device Security
    5. Configure Policies for Log Forwarding
    Download PDF
    Device Security

    Configure Policies for Log Forwarding

    Table of Contents

    Configure Policies for Log Forwarding

    Enable log forwarding so that the firewall sends Enhanced Application logs (EALs) to the logging service.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by PAN-OS or Panorama)
    One of the following subscriptions:
    • Device Security subscription
    • Precision AI bundle subscription
    • Device Security X subscription
    Enable log forwarding so that the firewall sends Enhanced Application logs (EALs) to the Palo Alto Networks cloud-based logging service. Device Security then fetches metadata from there for analysis.

    Configure Zone Metadata Collection

    When you configure policies for log forwarding, you can specify the source and destination zones that each policy applies to. Within each zone, you can specify a profile for the EAL application metadata collection. The profiles filter the log fields forwarded to Strata Logging Service based on the cloud services enabled on your NGFW.
    By default, the EAL application metadata collection uses the all profile, which means that the firewall forwards all log fields to Strata Logging Service. This can consume a lot of resources, especially at bandwidth-constrained sites.
    If you want to forward only the log fields that Device Security needs, you can assign the iot profile to the necessary zones.
    1. Log in to your NGFW and navigate to NetworkZones.
    2. + Add a zone or click on the name of an existing zone that you want to update.
    3. From the Metadata CollectionProfile dropdown, select iot.
    4. Click OK to save your changes.

    Configure an Interzone Policy

    If the VLAN interfaces are set in different L3 security zones from the Ethernet interfaces with which they're paired, Security policy rules must be configured for the solution to work. The figure below shows example rules when multiple VLAN interfaces have been configured to support multiple Ethernet interfaces.
    Policy rule 1: This policy rule allows relayed unicast DHCP messages from the zones assigned to interfaces ethernet1/1 - ethernet1/3 to the DHCP zone. In addition, enable log forwarding and choose the log-forwarding profile you previously created to send EALs for this traffic to the logging service.
    If you name the log forwarding profile "default" (all lowercase), the firewall will automatically apply it to new Security policy rules when they're created—or when they're imported from Device Security. Doing this will save you time and effort when importing Security policy rule recommendations from Device Security. Because imported rule recommendations don't include a log forwarding profile, you have to add one manually to each rule after you import it. However, by naming the profile "default", you can avoid this step. (Note that the "default" log forwarding profile will be applied when adding new Security policy rules, but it won't be retroactively applied to existing rules.)
    Policy rule 2: This rule allows ping (ICMP echo requests) from the VLAN interfaces in the DHCP zone to networks configured on ethernet1/1 - ethernet1/3.
    Policy rule 3: This rule allows ping from the IP addresses assigned to ethernet1/1 - ethernet1/3 to VLAN interfaces configured in the DHCP zone.

    Configure an Intrazone Policy

    You must override the logging and log forwarding settings in the default intrazone policy rule so that the firewall will forward logs to the logging service.
    If the interface hosting the DHCP server is in the same zone as the interface your clients are on, the default intrazone policy rule applies to this traffic, which, by default, allows all traffic within this zone but does not have logging and log forwarding enabled. Therefore, you must override this by enabling log forwarding on your default intrazone policy rule.
    Even for cases where the DHCP server is in a different zone from the DHCP clients and an interzone policy is applied to their DHCP traffic, we still recommend that you enable log forwarding on the default intrazone policy rule to capture the enhanced application logs for traffic within that zone.
    1. Click PoliciesSecurity, select intrazone-default, and then click Override.
      The Security Policy Rule configuration window appears.
    2. Click Actions, select Log at Session End, choose the log forwarding profile you just configured from the Log Forwarding drop-down, and then click OK.

    © 2026 Palo Alto Networks, Inc. All rights reserved.