Deploy Panorama M-Series Appliances with Local Log Collectors

The following figures illustrate Panorama in a centralized log collection deployment. In these examples, the Panorama management server comprises two M-Series appliances in Panorama mode that are deployed in an active/passive high availability (HA) configuration. The firewalls send logs to the predefined (default) local Log Collector on each Panorama M-Series appliance. This is the recommended deployment if the firewalls generate up to 10,000 logs/second.
If you will assign more than one Log Collector to a Collector Group, see Caveats for a Collector Group with Multiple Log Collectors to understand the requirements, risks, and recommended mitigations.
After implementing this deployment, if the logging rate increases beyond 10,000 logs per second, Palo Alto Networks recommends that you add Dedicated Log Collectors (M-Series appliances in Log Collector mode) as described in Deploy Panorama with Dedicated Log Collectors. Such an expansion might require reassigning firewalls from the local Log Collectors to Dedicated Log Collectors.
Single Local Log Collector Per Collector Group
Log_Collection_Default_Separate_CGs.png
Multiple Local Log Collectors Per Collector Group
Log_Collection_Default_Shared_CGs.png
Perform the following steps to deploy Panorama with local Log Collectors. Skip any steps you have already performed (for example, the initial setup).
  1. Perform the initial setup of each M-Series appliance.
    1. Rack mount the M-Series appliance. Refer to the M-Series Hardware Reference Guides for instructions.
    2. Palo Alto Networks recommends reserving the management (MGT) interface for administrative access to Panorama and dedicating separate M-Series Appliance Interfaces to other Panorama services.
    3. Configure each array. This task is required to make the RAID disks available for logging. Optionally, you can add disks to Increase Storage on the M-Series Appliance.
  2. Perform the following steps to prepare Panorama for log collection.
    1. Connect to the primary Panorama in one of the following ways:
      • Attach a serial cable from your computer to the Console port on the primary Panorama. Then use terminal emulation software (9600-8-N-1) to connect.
      • Use terminal emulation software such as PuTTY to open an SSH session to the IP address that you specified for the MGT interface of the primary Panorama during initial configuration.
    2. Log in to the CLI when prompted. Use the default admin account and the password that you specified during initial configuration.
    3. Enable the primary Panorama to connect to the secondary Panorama by entering the following command, where
      <IPaddress2>
      represents the MGT interface of the secondary Panorama:
      >
      configure
      #
      set deviceconfig system panorama-server
      <IPaddress2>
      #
      commit
    4. Log in to the CLI of the secondary Panorama.
    5. Enable the secondary Panorama to connect to the primary Panorama by entering the following command, where
      <IPaddress1>
      represents the MGT interface of the primary Panorama:
      >
      configure
      #
      set deviceconfig system panorama-server
      <IPaddress1>
      #
      commit
      #
      exit
    6. In the CLI of the secondary Panorama, enter the following command to display the serial number, and then record it:
      >
      show system info | match serial
      You need the serial number to add the Log Collector of the secondary Panorama as a managed collector to the primary Panorama.
  3. Edit the Log Collector that is local to the primary Panorama.
    Use the web interface of the primary Panorama to perform these steps:
    1. Select
      Panorama
      Managed Collectors
      and select the default (local) Log Collector.
    2. Select
      Disks
      and
      Add
      each logging disk pair.
    3. Click
      OK
      to save your changes.
  4. Configure the Log Collector that is local to the secondary Panorama.
    Panorama treats this Log Collector as remote because it’s not local to the primary Panorama. Therefore you must manually add it on the primary Panorama.
    Use the web interface of the primary Panorama to Configure a Managed Collector:
    1. Select
      Panorama
      Managed Collectors
      and
      Add
      the Log Collector.
    2. Enter the serial number (
      Collector S/N
      ) you recorded for the Log Collector of the secondary Panorama.
    3. Enter the IP address or FQDN of the primary and secondary Panorama HA peers in the
      Panorama Server IP
      field and
      Panorama Server IP 2
      field respectively. These fields are required.
    4. Select
      Interfaces
      and configure each interface that the Log Collector will use. The
      Management
      interface is required. Perform the following steps for each interface:
      1. Click the interface name.
      2. Configure one or both of the following field sets based on the IP protocols of your network.
        IPv4
        IP Address
        ,
        Netmask
        , and
        Default Gateway
        IPv6
        IPv6 Address/Prefix Length
        and
        Default IPv6 Gateway
      3. (
        Management interface only
        ) Select
        SNMP
        if you will use an SNMP manager to monitor Log Collector statistics.
        Using SNMP requires additional steps besides configuring the Log Collector (see Monitor Panorama and Log Collector Statistics Using SNMP).
      4. Click
        OK
        to save your changes to the interface.
    5. Click
      OK
      to save your changes to the Log Collector.
    6. Select
      Commit
      Commit to Panorama
      and
      Commit
      your changes.
      This step is required before you can enable logging disks.
    7. Edit the Log Collector by clicking its name.
    8. Select
      Disks
      ,
      Add
      each RAID disk pair, and click
      OK
      .
    9. Select
      Commit
      Commit to Panorama
      and
      Commit
      your changes.
  5. Use the web interface of the primary Panorama to perform this task for each firewall that will forward logs to the Log Collectors.
  6. Edit the default Collector Group that is predefined on the primary Panorama.
    Use the web interface of the primary Panorama to Configure a Collector Group:
    1. Select
      Panorama
      Collector Groups
      and edit the
      default
      Collector Group.
    2. Add
      the local Log Collector of the secondary Panorama to the Collector Group Members list if you are adding multiple Log Collectors to a single Collector group. By default, the list displays the local Log Collector of the primary Panorama because it is pre-assigned to the default Collector Group.
      In any single Collector Group, all the Log Collectors must run on the same Panorama model: all M-600 appliances, all M-500 appliances, all M-200 appliances, all M-100 appliances, or all Panorama virtual appliances.
    3. (
      Best Practice
      )
      Enable log redundancy across collectors
      if you add multiple Log Collectors to a single Collector group. This option requires each Log Collector to have the same number of logging disks.
    4. (
      Optional
      ) Select
      Monitoring
      and configure the settings if you will use SNMP to monitor Log Collector statistics and traps.
    5. Select
      Device Log Forwarding
      and configure the Log Forwarding Preferences list. This list defines which firewalls forward logs to which Log Collectors. Assign firewalls according to the number of Log Collectors in this Collector Group:
    6. Click
      OK
      to save your changes.
  7. Configure a Collector Group that contains the Log Collector of the secondary Panorama.
    Required if each Collector Group has only one Log Collector.
    Use the web interface of the primary Panorama to Configure a Collector Group:
    1. Select
      Panorama
      Collector Groups
      and
      Add
      the Collector Group.
    2. Enter a
      Name
      to identify the Collector Group.
    3. Add
      the local Log Collector of the secondary Panorama to the Collector Group Members list.
    4. (
      Optional
      ) Select
      Monitoring
      and configure the settings if you will use an SNMP manager to monitor Log Collector statistics and traps.
    5. Select
      Device Log Forwarding
      and
      Add
      an entry to the Log Forwarding Preferences list:
      1. Modify
        the Devices list, select the firewalls that will forward logs to the local Log Collector of the secondary Panorama (see Single Local Log Collector Per Collector Group), and click
        OK
        .
      2. Add
        the local Log Collector of the secondary Panorama to the Collectors list and click
        OK
        .
    6. Click
      OK
      to save your changes.
  8. Commit and push your changes to the Panorama configuration and the Collector Groups.
    In the web interface of the primary Panorama, select
    Commit
    Commit and Push
    and then
    Commit and Push
    your changes to Panorama and the Collector Groups you added.
  9. Manually fail over so that the secondary Panorama becomes active.
    Use the web interface of the primary Panorama to perform the following steps:
    1. Select
      Panorama
      High Availability
      .
    2. Click
      Suspend local Panorama
      in the Operational Commands section.
  10. On the secondary Panorama, configure the network settings of the Log Collector that is local to the primary Panorama.
    Use the web interface of the secondary Panorama to perform the following steps:
    1. In the Panorama web interface, select
      Panorama
      Managed Collectors
      and select the Log Collector that is local to the primary Panorama.
    2. Enter the IP address or FQDN of the secondary Panorama in the
      Panorama Server IP
      field and the IP address or FQDN of the primary Panorama in the
      Panorama Server IP 2
      field. These fields are required.
    3. Select
      Interfaces
      , click
      Management
      , and complete one or both of the following field sets (based on the IP protocols of your network) with the MGT interface values of the primary Panorama:
      • IPv4
        IP Address
        ,
        Netmask
        , and
        Default Gateway
      • IPv6
        IPv6 Address/Prefix Length
        and
        Default IPv6 Gateway
    4. Click
      OK
      to save your changes.
    5. Select
      Commit
      Commit and Push
      and then
      Commit and Push
      your changes to Panorama and the Collector Groups you added.
  11. Manually fail back so that the primary Panorama becomes active.
    Use the web interface of the secondary Panorama to perform the following steps:
    1. Select
      Panorama
      High Availability
      .
    2. Click
      Suspend local Panorama
      in the Operational Commands section.
  12. Configure log forwarding from firewalls to Panorama.
    Use the web interface of the primary Panorama to:
    1. You can assign separate external server profiles to each Panorama HA peer. For example, you might want each peer to forward logs to a different syslog server. To make each Panorama peer forward logs to different external services, log in to the web interface of each peer, select
      Panorama
      Collector Groups
      , select the Collector Group, select
      Collector Log Forwarding
      , assign the server profiles, and click
      OK
      .

Related Documentation