Configure a Collector Group
Table of Contents
10.0 (EoL)
Expand all | Collapse all
-
- Determine Panorama Log Storage Requirements
-
- Setup Prerequisites for the Panorama Virtual Appliance
- Perform Initial Configuration of the Panorama Virtual Appliance
- Set Up The Panorama Virtual Appliance as a Log Collector
- Set Up the Panorama Virtual Appliance with Local Log Collector
- Set up a Panorama Virtual Appliance in Panorama Mode
- Set up a Panorama Virtual Appliance in Management Only Mode
-
- Preserve Existing Logs When Adding Storage on Panorama Virtual Appliance in Legacy Mode
- Add a Virtual Disk to Panorama on an ESXi Server
- Add a Virtual Disk to Panorama on vCloud Air
- Add a Virtual Disk to Panorama on Alibaba Cloud
- Add a Virtual Disk to Panorama on AWS
- Add a Virtual Disk to Panorama on Azure
- Add a Virtual Disk to Panorama on Google Cloud Platform
- Add a Virtual Disk to Panorama on Hyper-V
- Add a Virtual Disk to Panorama on KVM
- Add a Virtual Disk to Panorama on Oracle Cloud Infrastructure (OCI)
- Mount the Panorama ESXi Server to an NFS Datastore
-
- Increase CPUs and Memory for Panorama on an ESXi Server
- Increase CPUs and Memory for Panorama on vCloud Air
- Increase CPUs and Memory for Panorama on Alibaba Cloud
- Increase CPUs and Memory for Panorama on AWS
- Increase CPUs and Memory for Panorama on Azure
- Increase CPUs and Memory for Panorama on Google Cloud Platform
- Increase CPUs and Memory for Panorama on Hyper-V
- Increase CPUs and Memory for Panorama on KVM
- Increase CPUs and Memory for Panorama on Oracle Cloud Infrastructure (OCI)
- Complete the Panorama Virtual Appliance Setup
-
- Convert Your Evaluation Panorama to a Production Panorama with Local Log Collector
- Convert Your Evaluation Panorama to a Production Panorama without Local Log Collector
- Convert Your Evaluation Panorama to VM-Flex Licensing with Local Log Collector
- Convert Your Evaluation Panorama to VM-Flex Licensing without Local Log Collector
- Convert Your Production Panorama to an ELA Panorama
-
- Register Panorama
- Activate a Panorama Support License
- Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is Internet-connected
- Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is not Internet-connected
- Activate/Retrieve a Firewall Management License on the M-Series Appliance
- Install the Panorama Device Certificate
-
- Panorama, Log Collector, Firewall, and WildFire Version Compatibility
- Install Updates for Panorama in an HA Configuration
- Install Updates for Panorama with an Internet Connection
- Install Updates for Panorama When Not Internet-Connected
- Install Updates Automatically for Panorama without an Internet Connection
- Migrate Panorama Logs to the New Log Format
-
- Migrate from a Panorama Virtual Appliance to an M-Series Appliance
- Migrate a Panorama Virtual Appliance to a Different Hypervisor
- Migrate from an M-Series Appliance to a Panorama Virtual Appliance
- Migrate from an M-100 Appliance to an M-500 Appliance
- Migrate from an M-100 or M-500 Appliance to an M-200 or M-600 Appliance
-
- Configure an Admin Role Profile
- Configure an Access Domain
-
- Configure a Panorama Administrator Account
- Configure Local or External Authentication for Panorama Administrators
- Configure a Panorama Administrator with Certificate-Based Authentication for the Web Interface
- Configure an Administrator with SSH Key-Based Authentication for the CLI
- Configure RADIUS Authentication for Panorama Administrators
- Configure TACACS+ Authentication for Panorama Administrators
- Configure SAML Authentication for Panorama Administrators
-
- Add a Firewall as a Managed Device
-
- Add a Device Group
- Create a Device Group Hierarchy
- Create Objects for Use in Shared or Device Group Policy
- Revert to Inherited Object Values
- Manage Unused Shared Objects
- Manage Precedence of Inherited Objects
- Move or Clone a Policy Rule or Object to a Different Device Group
- Push a Policy Rule to a Subset of Firewalls
- Manage the Rule Hierarchy
- Manage the Master Key from Panorama
- Redistribute Data to Managed Firewalls
-
- Add Standalone WildFire Appliances to Manage with Panorama
- Remove a WildFire Appliance from Panorama Management
-
-
- Configure a Cluster and Add Nodes on Panorama
- Configure General Cluster Settings on Panorama
- Remove a Cluster from Panorama Management
- Configure Appliance-to-Appliance Encryption Using Predefined Certificates Centrally on Panorama
- Configure Appliance-to-Appliance Encryption Using Custom Certificates Centrally on Panorama
- View WildFire Cluster Status Using Panorama
- Upgrade a Cluster Centrally on Panorama with an Internet Connection
- Upgrade a Cluster Centrally on Panorama without an Internet Connection
-
-
- Manage Licenses on Firewalls Using Panorama
-
- Supported Updates
- Schedule a Content Update Using Panorama
- Upgrade Log Collectors When Panorama Is Internet-Connected
- Upgrade Log Collectors When Panorama Is Not Internet-Connected
- Upgrade Firewalls When Panorama Is Internet-Connected
- Upgrade Firewalls When Panorama Is Not Internet-Connected
- Upgrade a ZTP Firewall
- Revert Content Updates from Panorama
-
- Preview, Validate, or Commit Configuration Changes
- Enable Automated Commit Recovery
- Compare Changes in Panorama Configurations
- Manage Locks for Restricting Configuration Changes
- Add Custom Logos to Panorama
- Use the Panorama Task Manager
- Reboot or Shut Down Panorama
- Configure Panorama Password Profiles and Complexity
-
-
- Verify Panorama Port Usage
- Resolve Zero Log Storage for a Collector Group
- Replace a Failed Disk on an M-Series Appliance
- Replace the Virtual Disk on an ESXi Server
- Replace the Virtual Disk on vCloud Air
- Migrate Logs to a New M-Series Appliance in Log Collector Mode
- Migrate Logs to a New M-Series Appliance in Panorama Mode
- Migrate Logs to a New M-Series Appliance Model in Panorama Mode in High Availability
- Migrate Logs to the Same M-Series Appliance Model in Panorama Mode in High Availability
- Migrate Log Collectors after Failure/RMA of Non-HA Panorama
- Regenerate Metadata for M-Series Appliance RAID Pairs
- View Log Query Jobs
- Troubleshoot Commit Failures
- Troubleshoot Registration or Serial Number Errors
- Troubleshoot Reporting Errors
- Troubleshoot Device Management License Errors
- Troubleshoot Automatically Reverted Firewall Configurations
- Complete Content Update When Panorama HA Peer is Down
- View Task Success or Failure Status
- Downgrade from Panorama 10.0
End-of-Life (EoL)
Configure a Collector Group
Before configuring Collector Groups, decide whether each
one will have a single Log Collector or multiple Log Collectors
(up to 16). A Collector Group with multiple Log Collectors supports
higher logging rates and log redundancy but has the following requirements:
- In any single Collector Group, all the Log Collectors must run on the same Panorama model: all M-600 appliances, all M-500 appliances, all M-200 appliances, or all Panorama virtual appliances.
- Log redundancy is available only if each Log Collector has the same number of logging disks. To add disks to a Log Collector, see Increase Storage on the M-Series Appliance.
- (Best Practice) All Log Collectors in the same Collector Group should be in the same local area network (LAN). Avoid adding Log Collectors in the same or different wide area networks (WAN) to the same Collector Group as network disruption are much more common and may result in log data loss. Additionally, it is recommended that Log Collectors in the same Collector Group be in close physical proximity to each other to allow Panorama to quickly query the Log Collectors when needed.
- Perform the following tasks before configuring
the Collector Group.
- Add a Firewall as a Managed Device for each firewall that you will assign to the Collector Group.
- Configure a Managed Collector for each Log Collector that you will assign to the Collector Group.
- Add the
Collector Group.
- Access the Panorama web interface, select PanoramaCollector Groups, and Add a Collector Group or edit an existing one.
- Enter a Name for the Collector
Group if you are adding one.You cannot rename an existing Collector Group.
- Enter the Minimum Retention Period in
days (1 to 2,000) for which the Collector Group will retain firewall logs.By default, the field is blank, which means the Collector Group retains logs indefinitely.
- Add Log Collectors (1 to 16) to the Collector Group Members list.
- (Recommended) Enable log redundancy
across collectors if you are adding multiple Log Collectors
to a single Collector group.Redundancy ensures that no logs are lost if any one Log Collector becomes unavailable. Each log will have two copies and each copy will reside on a different Log Collector. For example, if you have two Log Collectors in the collector group the log is written to both Log Collectors.Enabling redundancy creates more logs and therefore requires more storage capacity, reducing storage capability in half. When a Collector Group runs out of space, it deletes older logs. Redundancy also doubles the log processing traffic in a Collector Group, which reduces its maximum logging rate by half, as each Log Collector must distribute a copy of each log it receives.
- Assign Log Collectors and firewalls to the Collector
Group.
- Select Device Log Forwarding and Add log
forwarding preference lists for the firewalls.Log data is forwarded over a separate TCP channel. By adding a log forwarding preference, list you enable the creation of separate TCP connections for forwarding log data.A preference list determines the order in which Log Collectors receive logs from a firewall. If a log forwarding preference list is not assigned, you may encounter one of the following scenarios:
- If Panorama is in Management Only mode, Panorama drops all incoming logs.
- If the local Log Collector is not configured as a managed collector when Panorama is in Panorama mode, Panorama drops all incoming logs.
- If the local Log Collector is configured as a managed collector when Panorama is in Panorama mode, incoming logs are received but the Panorama may act as a bottleneck because all managed firewalls are forwarding logs to the local Log Collector first before being redistributed to other available Log Collectors.
- In the Devices section, Modify the list of firewalls and click OK.
- In the Collectors section, Add Log Collectors to the preference list.If you enabled redundancy in Step 2, it is recommended to add at least two Log Collectors. If you assign multiple Log Collectors, the first one will be the primary; if the primary becomes unavailable, the firewalls send logs to the next Log Collector in the list. To change the priority of a Log Collector, select it and Move Up (higher priority) or Move Down (lower priority).
- Click OK.
- Select Device Log Forwarding and Add log
forwarding preference lists for the firewalls.
- Define the storage capacity (log quotas) and expiration
period for each log type.
- Return to the General tab
and click the Log Storage value.If the field displays 0MB, verify that you enabled the disk pairs for logging and committed the changes (see Configure a Managed Collector, Disks tab).
- Enter the log storage Quota(%) for each log type.
- Enter the Max Days (expiration
period) for each log type (1 to 2,000).By default, the fields are blank, which means the logs never expire.
- Return to the General tab
and click the Log Storage value.
- Commit and verify your changes.
- Select CommitCommit and Push and then Commit and Push your changes to Panorama and the Collector Group you configured.
- Select PanoramaManaged Collectors to verify
the Log Collectors in the Collector Group are:
- Connected to Panorama—The Connected column displays a check mark icon to indicate that a Log Collector is connected to Panorama.
- Synchronized with Panorama—The Configuration Status column indicates whether a Log Collector is In Sync (green icon) or Out of Sync (red icon) with Panorama.
- Troubleshoot Connectivity to Network Resources to verify your firewalls successfully connected to the Log Collector.
- Next steps...
- Configure
Log Forwarding to Panorama.The Collector Group won’t receive firewall logs until you configure the firewalls to forward to Panorama.
- (Optional) Configure
Log Forwarding from Panorama to External Destinations.You can configure each Collector Group to forward logs to separate destinations (such as a syslog server).
- Configure
Log Forwarding to Panorama.