>
    PAN-OS
    Focus
    Download PDF
    Focus
    1. Home
    2. Strata Logging Service
    3. Onboard Firewalls to Strata Logging Service
    4. PAN-OS
    Download PDF
    Strata Logging Service

    PAN-OS

    Table of Contents

    PAN-OS

    Directly onboard your firewalls running PAN-OS to Strata Logging Service.

    Enable Communication Between Firewall and Strata Logging Service

    1. On your firewalls, allow access to the ports and FQDNs required to connect to Strata Logging Service. If you are using a proxy server, allow the same ports and FQDNs on the server without SSL decryption.
      Ensure that you are not decrypting traffic to Strata Logging Service.
    2. (Optional) To configure firewall to connect to Strata Logging Service through a proxy server, select DeviceSetupServicesUse proxy to send logs to Strata Logging Service.
    3. By default, the management interface is used to forward logs to Strata Logging Service. If you choose not to use the management interface, use a data interface by configuring destination service routes for the following FQDNs: api.paloaltonetworks.com, apitrusted.paloaltonetworks.com, lic.lc.prod.us.cs.paloaltonetworks.com,certificatetrusted.paloaltonetworks.com, certificate.paloaltonetworks.com.
      1. Select DeviceSetupServicesGlobal. Global on a firewall without multiple virtual system (multi-vsys) capability.
      2. Under Services Features, click Service Route Configuration.
      3. Select Customize.
      4. Under Service, select the following:
        • Palo Alto Networks Services
        • CRL status
        • DNS
        • HTTP
        • NTP
      5. Set Selected Service Routes.
      6. Select the Source Interface you want to use for activation and then select a Source Address from that interface and click OK.
      7. Select Destination and Add a destination.
      8. Enter any of the FQDNs above as Destination.
      9. Select the same Source Interface and Source Address that you selected for activation and click OK.
      10. Add two more destinations for the same interface using the remaining two FQDNs.
      11. Click OK again to exit Service Route Configuration.
      12. Update the access rules required to connect to Strata Logging Service for the new interface IP address.
    4. Configure NTP so that the firewall stays in sync with Strata Logging Service. Ignore this step if you have enabled proxy configuration:
      • On firewall, click DeviceSetupServices
         and set the NTP Server Address. For example: pool.ntp.org.

    Install Device Certificate

    1. Install a device certificate on the firewalls that you want to connect to Strata Logging Service. If you are switching from Strata Logging Service certificate to device certificate, run the following command to restart management-server: 
      > debug software restart process management-server
      • Restarting the management server process does not impact the packet forwarding except that the logged-in user will be signed out from the web interface and CLI.
      • It is recommended to perform any process restart during non-peak hours or during a maintenance window.

    Add Firewalls to Strata Logging Service

    The procedure to add firewalls to your Strata Logging Service tenant depends on the device type and the Strata Logging Service license scheme you are using. You must have enough licenses to add devices to tenant.
    All the devices (except VM-Flex devices) are onboarded through the Device Associations page, which can be accessed in two ways:
    • From the standalone app Inventory menu
    • From the Strata Cloud Manager Settings > Device Associations menu.

    Configure Firewalls to Connect to Strata Logging Service

    1. Select DeviceLicenses and confirm that the Strata Logging Service license is active. Ensure that you have subscribed to a valid support license of Strata Logging Service(90 days software warranty is not counted as a valid support license).
      When you purchased your Strata Logging Service license, all firewalls registered to your support account received a Strata Logging Service license. If you don’t see the Strata Logging Service license, Retrieve license keys from license server to manually refresh the firewall licenses.
    2. Set up the connection to Strata Logging Service and check connection status:
      1. Select DeviceSetupManagement and find the Cloud Logging settings.
      2. Enable Cloud Logging to connect the firewall to Strata Logging Service. If you want the firewall to collect data that increases visibility for Palo Alto Networks applications, like Cortex XDR, you can also Enable Enhanced Application Logging.
        Strata Logging Service logging doesn’t start until after you’ve specified the log types you want to forward. Complete these steps and then start sending logs to Strata Logging Service.
        Do not Enable Duplicate Logging. This option applies only to Panorama-managed firewalls.
      3. Select the Region where you want to forward logs for the firewalls associated with this template and then click OK.
        This region is not necessarily where your firewalls are located but the location of the Strata Logging Service instance. They will send logs to the region of the Strata Logging Service instance to which you onboarded them.
      4. Specify the Connection count to Strata Logging Service for PA-7000s and PA-5200s.
        Specify the number of connections that are established between the firewalls and Strata Logging Service for forwarding logs to Strata Logging Service (range is 1 to 20; default is 5).
      5. Commit and push the config to firewalls.
      6. Click DevicesSetupManagementCloud LoggingShow Status to check the connection status. The status for License, Certificate, and Customer Info should be green.
        You can also use this command to check the certificate status along with other details related to Strata Logging Service:request logging-service-forwarding status

    Verify the Connection Status

    1. Firewall fetches a certificate automatically after pushing the configuration. To check the certificate status:
      • On firewall, click Device > Setup > Management and find the Cloud Logging > Show Status to check Strata Logging Service status.
      • Run the command locally: 
        request logging-service-forwarding status
      If a certificate was not fetched for a firewall, run this command locally to fetch a certificate:
      request logging-service-forwarding certificate fetch
    2. On the hub, View Strata Logging Service Status to verify that Strata Logging Service is provisioned successfully.

    © 2024 Palo Alto Networks, Inc. All rights reserved.