Set Up the Panorama Virtual Appliance with Local Log Collector
If the Panorama virtual appliance is in Legacy
mode after you upgrade from a Panorama 8.0 or earlier release to
a Panorama 8.1 (or later) release, switch to Panorama mode in order
to create a local Log Collector, add multiple logging disks without
losing existing logs. increase log storage up to 24TB, and enable faster
report generation.
Once you change
from Legacy mode to Panorama mode, Legacy mode will no longer be
available.
After upgrading to Panorama 8.1, the first
step is to increase the system resources on the virtual appliance
to the minimum required for Panorama mode. Panorama reboots when
you increase resources, so perform this procedure during a maintenance
window. You must install a larger system disk (81GB), increase CPUs and memory based
on the log storage capacity, and add a virtual logging disk. The
new logging disk must have at least as much capacity as the appliance currently
uses in Legacy mode and cannot be less than 2TB. Adding a virtual
disk enables you to migrate existing logs to the Log Collector and
enables the Log Collector to store new logs.
If Panorama is
deployed in an HA configuration, perform the following steps on
the secondary peer first and then on the primary peer.
- Determine which system resources you need to increase before the virtual appliance can operate in Panorama mode.You must run the command specified in this step even if you have determined that Panorama already has adequate resources.
- Access the Panorama CLI:
- Use terminal emulation software such as PuTTY to open an SSH session to the IP address that you specified for the Panorama MGT interface.
- Log in to the CLI when prompted.
- Check the resources you must increase by running the following command:>request system system-mode panoramaEnterywhen prompted to continue. The output specifies the resources you must increase. For example:Panorama mode not supported on current system disk of size 52.0 GB. Please attach a disk of size 81.0 GB, then use 'request system clone-system-disk' to migrate the current system disk Please add a new virtual logging disk with more than 50.00 GB of storage capacity. Not enough CPU cores: Found 4 cores, need 8 cores
- Increase the CPUs and memory, and replace the system disk with a larger disk.
- Access the VMware ESXi vSphere Client, selectVirtual Machines, right-click the Panorama virtual appliance, and select.PowerPower Off
- Right-click the Panorama virtual appliance andEdit Settings.
- SelectMemoryand enter the newMemory Size.
- SelectCPUsand specify the number of CPUs (theNumber of virtual socketsmultiplied by theNumber of cores per socket).
- Add a virtual disk.You will use this disk to replace the existing system disk.
- In theHardwaresettings,Adda disk, selectHard Diskas the hardware type, and clickNext.
- Create a new virtual diskand clickNext.
- Set theDisk Sizeto exactly 81GB and select theThick Provision Lazy Zeroeddisk format.
- SelectSpecify a datastore or datastore structureas the location,Browseto a datastore of at least 81GB, clickOK, and clickNext.
- Select a SCSIVirtual Device Node(you can use the default selection) and clickNext.Panorama will fail to boot if you select a format other than SCSI.
- Verify that the settings are correct and then clickFinishandOK.
- Right-click the Panorama virtual appliance and select. Wait for Panorama to reboot before continuing.PowerPower On
- Return to the Panorama CLI and copy the data from the original system disk to the new system disk:>request system clone-system-disk target sdbEnterywhen prompted to continue.The copying process takes around 20 to 25 minutes, during which Panorama reboots. When the process finishes, the output tells you to shut down Panorama.
- Return to the vSphere Client console, right-click the Panorama virtual appliance, and select.PowerPower Off
- Right-click the Panorama virtual appliance andEdit Settings.
- Select the original system disk, clickRemove, selectRemove from virtual machine, and clickOK.
- Right-click the Panorama virtual appliance andEdit Settings.
- Select the new system disk, set theVirtual Device NodetoSCSI (0:0), and clickOK.
- Right-click the Panorama virtual appliance and select. Before proceeding, wait for Panorama to reboot on the new system disk (around 15 minutes).PowerPower On
- Add a virtual logging disk.This is the disk to which you will migrate existing logs.
- In the VMware ESXi vSphere Client, right-click the Panorama virtual appliance and select.PowerPower Off
- Right-click the Panorama virtual appliance andEdit Settings.
- Repeat the steps to Add a virtual disk. Set theDisk Sizeto a multiple of 2TB based on the amount of log storage you need. The capacity must be at least as large as the existing virtual disk or NFS storage that Panorama currently uses for logs. The disk capacity must be a multiple of 2TB and can be up to 24TB. For example, if the existing disk has 5TB of log storage, you must add a new disk of at least 6TB.After you switch to Panorama mode, Panorama will automatically divide the new disk into 2TB partitions, each of which will function as a separate virtual disk.
- Right-click the Panorama virtual appliance and select. Wait for Panorama to reboot before continuing.PowerPower On
- Switch from Legacy mode to Panorama mode.After switching the mode, the appliance reboots again and then automatically creates a local Log Collector and Collector Group. The existing logs won’t be available for querying or reporting until you migrate them later in this procedure.
- Return to the Panorama CLI and run the following command.>request system system-mode panoramaEnterywhen prompted to continue. After rebooting, Panorama automatically creates a local Log Collector (named Panorama) and creates a Collector Group (named default) to contain it. Panorama also configures the virtual logging disk you added and divides it into separate 2TB disks. Wait for the process to finish and for Panorama to reboot (around five minutes) before continuing.
- Log in to the Panorama web interface.
- In theDashboard,General Informationsettings, verify that theModeis nowpanorama.In an HA deployment, the secondary peer is in a suspended state at this point because its mode (Panorama) does not match the mode on the primary peer (Legacy). You will un-suspend the secondary peer after switching the primary peer to Panorama mode later in this procedure.
- Selectto verify that thePanoramaCollector Groupsdefaultcollector group has been created, and that the local Log Collector is part of the default collector group.
- Push the configuration to the managed devices.
- If there are no pending changes:
- SelectandCommitPush to DevicesEdit Selections.
- SelectCollector Groupand make sure thedefaultcollector group is selected.
- ClickOKandPush.
- If you have pending changes:
- SelectandCommitCommit and PushEdit Selections.
- Verify that yourDevice Groupdevices andTemplatesare included.
- SelectCollector Groupand make sure thedefaultcollector group is selected.
- ClickOKandCommit and Push.
- Selectand verify that the columns display the following information for the local Log Collector:PanoramaManaged Collectors
- Collector Name—This defaults to the Panorama hostname. It should be listed under thedefaultCollector Group.
- Connected—Check mark
- Configuration Status—In sync
- Run Time Status—connected
- (HA only) Switch the primary Panorama from Legacy mode to Panorama mode.This step triggers failover.
- On the primary Panorama, selectDashboardand, in the High Availability section,Sync to peer, clickYes, and wait for theRunning Configto displaySynchronizedstatus.
- On the secondary Panorama, selectand, in the Operational Commands section,PanoramaHigh AvailabilityMake local Panorama functional.This step is necessary to bring the secondary Panorama out of its suspended HA state.
- Migrate existing logs to the new virtual logging disks.If you deployed Panorama in an HA configuration, perform this only on the primary peer.
- Return to the Panorama CLI.
- Start the log migration:>request logdb migrate vm startThe process duration varies by the volume of log data you are migrating. To check the status of the migration, run the following command:>request logdb migrate vm statusWhen the migration finishes, the output displays:migration has been done.
- Verify that the existing logs are available.
- Log in to the Panorama web interface.
- Select, select a log type that you know matches some existing logs (for example,PanoramaMonitor), and verify that the logs display.PanoramaMonitorSystem
- Next steps...Configure log forwarding to Panorama so that the Log Collector receives new logs from firewalls.
Recommended For You
Recommended Videos
Recommended videos not found.