The following figure illustrates Panorama in a centralized log collection deployment. In this example, the Panorama management server comprises two Panorama virtual appliances that are deployed in an active/passive high availability (HA) configuration. This configuration suits firewall management within a VMware virtual infrastructure in which Panorama processes up to 10,000 logs/second. (For details on deployment options, see
Plan a Log Collection Deployment.) The firewalls send logs to the Panorama management server (to its virtual disk or Network File System [NFS] datastore). By default, the active and passive peers both receive logs, though you can
Modify Log Forwarding and Buffering Defaults so that only the active peer does. By default, the Panorama virtual appliance uses approximately 11GB on its internal disk partition for log storage, though you can
Expand Log Storage Capacity on the Panorama Virtual Appliance if necessary.
If the logging rate increases beyond 10,000 logs per second, it is recommended that you add Dedicated Log Collectors (M-Series appliances in Log Collector mode).
Deploy Panorama with Dedicated Log Collectors describes a deployment with Dedicated Log Collectors managed by Panorama virtual appliances or by M-Series appliances in Panorama mode.
Figure: Panorama Virtual Appliances with Local Log Collection
Perform the following steps to deploy Panorama virtual appliances with local log collection. Skip any steps you have already performed (for example, the initial setup).
Deploy Panorama Virtual Appliances with Local Log Collection
Perform the initial setup of each Panorama virtual appliance.