Deploy Panorama M-Series Appliances with Local Log Collectors

The following figures illustrate Panorama in a centralized log collection deployment. In these examples, the Panorama management server comprises two M-Series appliances in Panorama mode that are deployed in an active/passive high availability (HA) configuration. The firewalls send logs to the predefined (default) local Log Collector on each Panorama M-Series appliance. This is the recommended deployment if the firewalls generate up to 10,000 logs/second.

If you will assign more than one Log Collector to a Collector Group, see Caveats for a Collector Group with Multiple Log Collectors to understand the requirements, risks, and recommended mitigations.

After implementing this deployment, if the logging rate increases beyond 10,000 logs per second, Palo Alto Networks recommends that you add Dedicated Log Collectors (M-Series appliances in Log Collector mode) as described in Deploy Panorama with Dedicated Log Collectors. Such an expansion might require reassigning firewalls from the local Log Collectors to Dedicated Log Collectors.

Perform the following steps to deploy Panorama with local Log Collectors. Skip any steps you have already performed (for example, the initial setup).

1. Perform the initial setup of each M-Series appliance.
   1. Rack mount the M-Series appliance. Refer to the M-Series Hardware Reference Guides for instructions.
   2. Perform Initial Configuration of the M-Series Appliance.
      Palo Alto Networks recommends reserving the management (MGT) interface for administrative access to Panorama and dedicating separate M-Series Appliance Interfaces to other Panorama services.
   3. Configure each array. This task is required to make the RAID disks available for logging. Optionally, you can add disks to Increase Storage on the M-Series Appliance.
   4. Register Panorama and Install Licenses.
   5. Install Content and Software Updates for Panorama.
   6. Set Up HA on Panorama.
2. Perform the following steps to prepare Panorama for log collection.
   1. Connect to the primary Panorama in one of the following ways:
      • Attach a serial cable from your computer to the Console port on the primary Panorama. Then use terminal emulation software (9600-8-N-1) to connect.
      • Use terminal emulation software such as PuTTY to open an SSH session to the IP address that you specified for the MGT interface of the primary Panorama during initial configuration.
   2. Log in to the CLI when prompted. Use the default admin account and the password that you specified during initial configuration.
   3. Enable the primary Panorama to connect to the secondary Panorama by entering the following command, where <IPaddress2> represents the MGT interface of the secondary Panorama:

      > configure  
      # set deviceconfig system panorama-server <IPaddress2>  
      # commit  

   4. Log in to the CLI of the secondary Panorama.
   5. Enable the secondary Panorama to connect to the primary Panorama by entering the following command, where <IPaddress1> represents the MGT interface of the primary Panorama:

      > configure  
      # set deviceconfig system panorama-server <IPaddress1>  
      # commit  
      # exit  

   6. In the CLI of the secondary Panorama, enter the following command to display the serial number, and then record it:

      > show system info | match serial

      You need the serial number to add the Log Collector of the secondary Panorama as a managed collector to the primary Panorama.
3. Edit the Log Collector that is local to the primary Panorama.
   Use the web interface of the primary Panorama to perform these steps:
   1. Select PanoramaManaged Collectors and select the default (local) Log Collector.
   2. Select Disks and Add each logging disk pair.
   3. Click OK to save your changes.
4. Configure the Log Collector that is local to the secondary Panorama.
   Panorama treats this Log Collector as remote because it’s not local to the primary Panorama. Therefore you must manually add it on the primary Panorama.

   Use the web interface of the primary Panorama to Configure a Managed Collector:
   1. Select PanoramaManaged Collectors and Add the Log Collector.
   2. Enter the serial number (Collector S/N) you recorded for the Log Collector of the secondary Panorama.
   3. Enter the IP address or FQDN of the primary and secondary Panorama HA peers in the Panorama Server IP field and Panorama Server IP 2 field respectively.
      Both of these fields are required.
   4. Select Interfaces and configure each interface that the Log Collector will use. The Management interface is required. Perform the following steps for each interface:
      1. Click the interface name.
      2. Configure one or both of the following field sets based on the IP protocols of your network.
         IPv4—IP Address, Netmask, and Default Gateway
         IPv6—IPv6 Address/Prefix Length and Default IPv6 Gateway
      3. (Management interface only) Select SNMP if you will use an SNMP manager to monitor Log Collector statistics.
         Using SNMP requires additional steps besides configuring the Log Collector (see Monitor Panorama and Log Collector Statistics Using SNMP).
      4. Click OK to save your changes to the interface.
   5. Click OK to save your changes to the Log Collector.
   6. Select CommitCommit to Panorama and Commit your changes.
      This step is required before you can enable logging disks.
   7. Edit the Log Collector by clicking its name.
   8. Select Disks, Add each RAID disk pair, and click OK.
   9. Select CommitCommit to Panorama and Commit your changes.
5. Add a Firewall as a Managed Device.
   Use the web interface of the primary Panorama to perform this task for each firewall that will forward logs to the Log Collectors.
6. Edit the default Collector Group that is predefined on the primary Panorama.
   Use the web interface of the primary Panorama to Configure a Collector Group:
   1. Select PanoramaCollector Groups and edit the default Collector Group.
   2. Add the local Log Collector of the secondary Panorama to the Collector Group Members list if you are adding multiple Log Collectors to a single Collector group. By default, the list displays the local Log Collector of the primary Panorama because it is pre-assigned to the default Collector Group.
      In any single Collector Group, all the Log Collectors must run on the same Panorama model: all M-600 appliances, all M-500 appliances, all M-200 appliances, all M-100 appliances, or all Panorama virtual appliances.
   3. (Best Practice) Enable log redundancy across collectors if you add multiple Log Collectors to a single Collector group. This option requires each Log Collector to have the same number of logging disks.
   4. (Optional) Select Monitoring and configure the settings if you will use SNMP to monitor Log Collector statistics and traps.
   5. Select Device Log Forwarding and configure the Log Forwarding Preferences list. This list defines which firewalls forward logs to which Log Collectors. Assign firewalls according to the number of Log Collectors in this Collector Group:
      • Single—Assign the firewalls that will forward logs to the local Log Collector of the primary Panorama, as illustrated in Single Local Log Collector Per Collector Group.
      • Multiple—Assign each firewall to both Log Collectors for redundancy. When you configure the preferences, make Log Collector 1 the first priority for half the firewalls and make Log Collector 2 the first priority for the other half, as illustrated in Multiple Local Log Collectors Per Collector Group.
   6. Click OK to save your changes.
7. Configure a Collector Group that contains the Log Collector of the secondary Panorama.
   Required if each Collector Group has only one Log Collector.

   Use the web interface of the primary Panorama to Configure a Collector Group:
   1. Select PanoramaCollector Groups and Add the Collector Group.
   2. Enter a Name to identify the Collector Group.
   3. Add the local Log Collector of the secondary Panorama to the Collector Group Members list.
   4. (Optional) Select Monitoring and configure the settings if you will use an SNMP manager to monitor Log Collector statistics and traps.
   5. Select Device Log Forwarding and Add an entry to the Log Forwarding Preferences list:
      1. Modify the Devices list, select the firewalls that will forward logs to the local Log Collector of the secondary Panorama (see Single Local Log Collector Per Collector Group), and click OK.
      2. Add the local Log Collector of the secondary Panorama to the Collectors list and click OK.
   6. Click OK to save your changes.
8. Commit and push your changes to the Panorama configuration and the Collector Groups.
   In the web interface of the primary Panorama, select CommitCommit and Push and then Commit and Push your changes to Panorama and the Collector Groups you added.
9. Manually fail over so that the secondary Panorama becomes active.
   Use the web interface of the primary Panorama to perform the following steps:
   1. Select PanoramaHigh Availability.
   2. Click Suspend local Panorama in the Operational Commands section.
10. On the secondary Panorama, configure the network settings of the Log Collector that is local to the primary Panorama.
    Use the web interface of the secondary Panorama to perform the following steps:
    1. In the Panorama web interface, select PanoramaManaged Collectors and select the Log Collector that is local to the primary Panorama.
    2. Enter the IP address or FQDN of the primary and secondary Panorama HA peers in the Panorama Server IP field and Panorama Server IP 2 field respectively.
       Both of these fields are required.
    3. Select Interfaces, click Management, and complete one or both of the following field sets (based on the IP protocols of your network) with the MGT interface values of the primary Panorama:
       • IPv4—IP Address, Netmask, and Default Gateway
       • IPv6—IPv6 Address/Prefix Length and Default IPv6 Gateway
    4. Click OK to save your changes.
    5. Select CommitCommit and Push and then Commit and Push your changes to Panorama and the Collector Groups you added.
11. Manually fail back so that the primary Panorama becomes active.
    Use the web interface of the secondary Panorama to perform the following steps:
    1. Select PanoramaHigh Availability.
    2. Click Suspend local Panorama in the Operational Commands section.
12. Configure log forwarding from firewalls to Panorama.
    Use the web interface of the primary Panorama to:
    1. Configure Log Forwarding to Panorama.
    2. Verify Log Forwarding to Panorama.
    3. (Optional) Configure Log Forwarding from Panorama to External Destinations.
       You can assign separate external server profiles to each Panorama HA peer. For example, you might want each peer to forward logs to a different syslog server. To make each Panorama peer forward logs to different external services, log in to the web interface of each peer, select PanoramaCollector Groups, select the Collector Group, select Collector Log Forwarding, assign the server profiles, and click OK.