The following figures illustrate Panorama in a centralized log collection deployment. In these examples, the Panorama management server comprises two M-Series appliances in Panorama mode that are deployed in an active/passive high availability (HA) configuration. The firewalls send logs to the predefined (default) local Log Collector on each Panorama M-Series appliance. This is the recommended deployment if the firewalls generate up to 10,000 logs/second. (For details on deployment options, see Plan a Log Collection Deployment.)
If you will assign more than one Log Collector to a Collector Group, see Caveats for a Collector Group with Multiple Log Collectors to understand the requirements, risks, and recommended mitigations. After implementing this deployment, if the logging rate increases beyond 10,000 logs per second, Palo Alto Networks recommends that you add Dedicated Log Collectors (M-Series appliances in Log Collector mode) as described in Deploy Panorama with Dedicated Log Collectors. Such an expansion might require reassigning firewalls from the default Log Collectors to Dedicated Log Collectors.
Figure: Single Default Log Collector Per Collector Group
Figure: Multiple Default Log Collectors Per Collector Group
Perform the following steps to deploy Panorama with default Log Collectors. Skip any steps you have already performed (such as the initial setup).
Deploy Panorama with Default Log Collectors
Perform the initial setup of each M-Series appliance. Rack mount the M-Series appliance. Refer to the M-100 or M-500 Hardware Reference Guide for instructions. Perform Initial Configuration of the M-Series Appliance. To reduce the traffic load on the management (MGT) interface and to improve security for management traffic, Palo Alto Networks recommends configuring Panorama to use the Eth1 and Eth2 interfaces for log collection and Collector Group communication. Configure each array. This task is required to make the RAID disks available for logging. Optionally, you can add disks to Increase Storage on the M-Series Appliance. Register Panorama and Install Licenses. Install Content and Software Updates for Panorama. Set Up HA on Panorama.
Perform the following steps to prepare Panorama for log collection. Connect to the primary Panorama in one of the following ways: Attach a serial cable from your computer to the Console port on the primary Panorama. Then use terminal emulation software (9600-8-N-1) to connect. Use terminal emulation software such as PuTTY to open an SSH session to the IP address that you specified for the MGT interface of the primary Panorama during initial configuration. Log in to the CLI when prompted. Use the default admin account and the password that you specified during initial configuration. Enable the primary Panorama to connect to the secondary Panorama by entering the following command, where <IPaddress2> represents the MGT interface of the secondary Panorama: > configure # set deviceconfig system panorama-server <IPaddress2> # commit Log in to the CLI of the secondary Panorama. Enable the secondary Panorama to connect to the primary Panorama by entering the following command, where <IPaddress1> represents the MGT interface of the primary Panorama: > configure # set deviceconfig system panorama-server <IPaddress1> # commit # exit In the CLI of the secondary Panorama, enter the following command to display the serial number, and then record it: > show system info | match serial You need the serial number to add the Log Collector of the secondary Panorama as a managed collector to the primary Panorama.
Edit the Log Collector that is local to the primary Panorama. Use the web interface of the primary Panorama to perform these steps: Select Panorama > Managed Collectors and select the default Log Collector. ( Optional ) Select the interfaces (MGT, Eth1, or Eth2) to use for Device Log Collection and Collector Group Communication. By default, Panorama uses the MGT interface for these functions. The Eth1 and Eth2 interfaces are available only if you configured them for the Panorama management server during initial configuration. Select Disks and Add each logging disk pair. Click OK to save your changes.
Configure the Log Collector that is local to the secondary Panorama. Panorama treats this Log Collector as remote because it’s not local to the primary Panorama. Therefore you must manually add it on the primary Panorama. Use the web interface of the primary Panorama to Configure a Managed Collector: Select Panorama > Managed Collectors and Add the Log Collector. Enter the serial number ( Collector S/N) you recorded for the Log Collector of the secondary Panorama. Enter the IP address or FQDN of the primary and secondary Panorama HA peers in the Panorama Server IP field and Panorama Server IP 2 field respectively. These fields are required. Configure the network settings of each interface that the Log Collector will use. The Management interface is required. If you configured the Panorama management server to use the Eth1 and Eth2 interfaces, configure these interfaces on the Log Collector also. For each interface, select the corresponding tab and configure one or both of the following field sets based on the IP protocols of your network. IPv4— IP Address, Netmask, and Default Gateway IPv6— IPv6 Address/Prefix Length and Default IPv6 Gateway ( Optional ) For the Management interface, select SNMP if you will use an SNMP manager to monitor Log Collector statistics. Using SNMP requires additional steps besides configuring the Log Collector (see Monitor Panorama and Log Collector Statistics Using SNMP). Click OK and Commit, set the Commit Type to Panorama, and click Commit again. This step is required before you can enable logging disks or assign the Eth1 and Eth2 interfaces to logging functions. ( Optional ) Select Panorama > Managed Collectors, edit the Log Collector, and select the interfaces (MGT, Eth1, or Eth2) that it will use for Device Log Collection and Collector Group Communication (default is MGT). Select Disks and Add each logging disk pair. Click OK and Commit, set the Commit Type to Panorama, and click Commit again.
Add a Firewall as a Managed Device. Use the web interface of the primary Panorama to perform this task for each firewall that will forward logs to the Log Collectors.
Edit the default Collector Group that is predefined on the primary Panorama. Use the web interface of the primary Panorama to Configure a Collector Group: Select Panorama > Collector Groups and select the default Collector Group. If you add multiple Log Collectors to a single Collector group, Enable log redundancy across collectors as a best practice. ( Optional ) Select the Monitoring tab and configure the settings if you will use SNMP to monitor Log Collector statistics and traps. Select Device Log Forwarding. The Collector Group Members section displays the local Log Collector of the primary Panorama because it is pre-assigned to the default Collector Group. Optionally, Add the local Log Collector of the secondary Panorama. In the Log Forwarding Preferences section, assign firewalls according to the number of Log Collectors in this Collector Group: Single—Assign the firewalls that will forward logs to the default Log Collector of the primary Panorama, as illustrated in Figure: Single Default Log Collector Per Collector Group. Multiple—Assign each firewall to both Log Collectors for redundancy. When you configure the preferences, make Log Collector 1 the first priority for half the firewalls and make Log Collector 2 the first priority for the other half, as illustrated in Figure: Multiple Default Log Collectors Per Collector Group. Click OK to save your changes.
Configure a Collector Group that contains the Log Collector of the secondary Panorama. Required if each Collector Group has only one Log Collector. Use the web interface of the primary Panorama to Configure a Collector Group: Select Panorama > Collector Groups and Add the Collector Group. Enter a Name to identify the Collector Group. ( Optional ) Select the Monitoring tab and configure the settings if you will use an SNMP manager to monitor Log Collector statistics and traps. Select the Device Log Forwarding tab and, in the Collector Group Members section, Add the default Log Collector of the secondary Panorama. In the Log Forwarding Preferences section, assign the firewalls that will forward logs to the default Log Collector of the secondary Panorama, as illustrated in Figure: Single Default Log Collector Per Collector Group. Click OK to save your changes.
Commit your changes. Use the web interface of the primary Panorama to perform the following steps: Click Commit, set the Commit Type to Panorama, and click Commit again. Click Commit, set the Commit Type to Collector Group, select the Collector Groups you added, and click Commit again.
Manually fail over so that the secondary Panorama becomes active. Use the web interface of the primary Panorama to perform the following steps: Select Panorama > High Availability. Click Suspend local Panorama in the Operational Commands section.
On the secondary Panorama, configure the network settings of the Log Collector that is local to the primary Panorama. Use the web interface of the secondary Panorama to perform the following steps: In the Panorama web interface, select Panorama > Managed Collectors and select the Log Collector that is local to the primary Panorama. Enter the IP address or FQDN of the secondary Panorama in the Panorama Server IP field and the IP address or FQDN of the primary Panorama in the Panorama Server IP 2 field. These fields are required. Select the Management tab and complete one or both of the following field sets (based on the IP protocols of your network) with the management interface values of the primary Panorama: IPv4— IP Address, Netmask, and Default Gateway IPv6— IPv6 Address/Prefix Length and Default IPv6 Gateway Click OK and Commit, set the Commit Type to Panorama, and click Commit again. Wait until the HA synchronization finishes before proceeding. Click Commit, set the Commit Type to Collector Group, select the Collector Groups you added, and click Commit again.
Manually fail back so that the primary Panorama becomes active. Use the web interface of the secondary Panorama to perform the following steps: Select Panorama > High Availability. Click Suspend local Panorama in the Operational Commands section.
Configure log forwarding. Use the web interface of the primary Panorama to: Configure Log Forwarding to Panorama. Verify Log Forwarding to Panorama. ( Optional ) Configure Log Forwarding from Panorama to External Destinations. You can configure separate external server profiles for different log types and severity levels. You can also assign separate profiles to each Panorama HA peer. For example, you might want each peer to forward logs to a different syslog server. To make each Panorama peer forward logs to different external services, log in to the web interface of each peer, select Panorama > Collector Groups, select the Collector Group, select Collector Log Forwarding, assign the server profiles, and click OK.

Related Documentation