Configure Log Forwarding from Panorama to External Destinations

1. Configure the firewalls to forward logs to Panorama.

   Configure Log Forwarding to Panorama.
2. Configure a server profile for each external service that will receive log information.

   1. Select PanoramaServer Profiles and select the type of server that will receive the log data: SNMP Trap, Syslog, Email, or HTTP.
   2. Configure the server profile:

      • Configure an SNMP Trap server profile. For details on how SNMP works for Panorama and Log Collectors, refer to SNMP Support.
      • Configure a Syslog server profile. If the syslog server requires client authentication, use the PanoramaCertificate ManagementCertificates page to create a certificate for securing syslog communication over SSL.
        When you configure your external syslog server to receive logs forwarded via a Log Collector, configure the syslog server to accept connections from the Log Collector's IP address, not from the Panorama management IP address. The Log Collector forwards the logs, so the source IP address of the forwarded logs is the Log Collector's IP address.
      • Configure an Email server profile.
      • Configure an HTTP server profile.
        Log forwarding to an HTTP server is designed for log forwarding at low frequencies and is not recommend for deployments with a high volume of log forwarding. You may experience log loss when forwarding to an HTTP server if your deployment generate a high volume of logs that need to be forwarded.
3. Configure destinations for:

   • Logs that the Panorama management server and Log Collectors generate.
   • Firewall logs that a Panorama virtual appliance collects.

   1. Select PanoramaLog Settings.
   2. Add one or more match list profiles for each log type.

      The profiles specify log query filters, forwarding destinations, and automatic actions such as tagging. For each match list profile:

      1. Enter a Name to identify the profile.
      2. Select the Log Type.
      3. In the Filter drop-down, select Filter Builder. Specify the following and then Add each query:
         Connector logic (and/or)
         Log Attribute
         Operator to define inclusion or exclusion logic
         Attribute Value for the query to match
      4. Add the server profiles you configured for each external service.
      5. Click OK to save the profile.
4. Configure destinations for firewall logs that Log Collectors receive.

   Each Collector Group can forward logs to different destinations. If the Log Collectors are local to a high availability (HA) pair of Panorama management servers, you must log into each HA peer to configure log forwarding for its Collector Group.

   1. Select PanoramaCollector Groups and edit the Collector Group that receives the firewall logs.
   2. (Optional, SNMP trap forwarding only) Select Monitoring and configure the SNMP settings.
   3. Select Collector Log Forwarding and Add configured match list profiles as necessary.
   4. Click OK to save your changes to the Collector Group.
5. (Syslog forwarding only) If the syslog server requires client authentication and the firewalls forward logs to Dedicated Log Collectors, assign a certificate that secures syslog communication over SSL.

   Perform the following steps for each Dedicated Log Collector:

   1. Select PanoramaManaged Collectors and edit the Log Collector.
   2. Select the Certificate for Secure Syslog and click OK.
6. (SNMP trap forwarding only) Enable your SNMP manager to interpret traps.

   Load the Supported MIBs and, if necessary, compile them. For the specific steps, refer to the documentation of your SNMP manager.
7. Commit and verify your configuration changes.

   1. Select CommitCommit and Push to commit your changes to Panorama and push the changes to device groups, templates, and Collector Groups.
   2. Verify that the external services are receiving the log information:

      • Email server—Verify that the specified recipients are receiving logs as email notifications.
      • Syslog server—Refer to the documentation for your syslog server to verify it’s receiving logs as syslog messages.
      • SNMP manager—Refer to the documentation for your SNMP trap server to verify it’s receiving logs as SNMP traps.
      • HTTP server—Verify that the HTTP-based server is receiving logs in the correct payload format.