Focus

PAN-OS Web Interface Help

Log Collector Authentication Settings

Table of Contents

Log Collector Authentication Settings

Panorama > Managed Collectors > Authentication

An M-Series appliance or Panorama virtual appliance in Log Collector mode (Dedicated Log Collector) does not have a web interface; only a CLI. You can use the Panorama management server to configure most settings on a Dedicated Log Collector but some settings require CLI access. To configure authentication settings for CLI access, configure the settings as described in the following table.

Log Collector Authentication Settings	Description
Authentication Profile	Select a configured authentication profile to define the authentication service that validates the login credentials of the Dedicated Log Collector or Panorama administrators.
Failed Attempts	Enter the number of failed login attempts that the Dedicated Log Collector allows on the CLI before locking out the administrator (range is 0 to 10; default is 10). Limiting login attempts helps protect the WildFire appliance from brute force attacks. A value of 0 specifies unlimited login attempts. If you set the Failed Attempts to a value other than 0 but leave the Lockout Time at 0, then the administrator is indefinitely locked out until another administrator manually unlocks the locked-out administrator. If no other administrator has been created, you must reconfigure the Failed Attempts and Lockout Time settings on Panorama and push the configuration change to the Log Collector. To ensure that an administrator is never locked out, use the default (0) value for both Failed Attempts and Lockout Time. Set the number of Failed Attempts to 5 or fewer to accommodate a reasonable number of retries in case of typing errors, while preventing malicious systems from trying brute force methods to log in to the Dedicated Log Collector.
Lockout Time (min)	Enter the number of minutes for which the Dedicated Log Collector locks out an administrator from access to the CLI after reaching the Failed Attempts limit (range is 0 to 60; default is 5). A value of 0 means the lockout applies until another administrator manually unlocks the account. If you set the Failed Attempts to a value other than 0 but leave the Lockout Time at 0, then the administrator is indefinitely locked out until another administrator manually unlocks the locked-out administrator. If no other administrator has been created, you must reconfigure the Failed Attempts and Lockout Time settings on Panorama and push the configuration change to the Log Collector. To ensure that an administrator is never locked out, use the default (0) value for both Failed Attempts and Lockout Time. Set the Lockout Time to at least 30 minutes to prevent continuous login attempts from a malicious actor.
Idle Timeout (min)	Enter the maximum number of minutes without any activity on the CLI before an administrator is automatically logged out (range is 0 to 1,440; default is None). A value of 0 means that inactivity does not trigger an automatic logout. Set the Idle Timeout to 10 minutes to prevent unauthorized users from accessing the Dedicated Log Collector if an administrator leaves a session open.
Max Session Count	Enter the number of active sessions the administrator can have open concurrently, The default is 0, which means that the Dedicated Log Collector can have an unlimited number of concurrently active sessions.
Max Session time	Enter the number of minutes the administrator can be logged in before being automatically logged out. The default is 0, which means that the administrator can be logged in indefinitely even if idle.
Local Administrators	Add and configure new administrators for the Dedicated Log Collector. These administrators are unique to the Dedicated Log Collector are managed from this page (PanoramaManaged CollectorsAuthentication).
Panorama Administrators	Import existing administrators configured on Panorama. These administrators are created on Panorama and imported to the Dedicated Log Collector.

General Log Collector Settings

Log Collector Interface Settings