©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
127
Manage
Log
Collection
Enable
Log
Forwarding
from
Panorama
to
External
Destinations
Step
2
If
the
Syslog
server
requires
client
authentication,
generate
the
certificate
for
secure
communication.
To
verify
that
the
sending
device
(firewall
or
Panorama)
is
authorized
to
communicate
with
the
syslog
server,
you
must
enable
the
following:
•
The
server
and
the
sending
device
must
have
certificates
that
are
signed
by
the
same
trusted
CA.
Alternatively,
you
can
generate
a
self
‐
signed
certificate
on
Panorama
or
the
firewall,
export
the
certificate
from
the
firewall/Panorama
and
import
it
in
to
the
syslog
server.
•
Use
the
trusted
CA
or
the
self
‐
signed
certificate
to
generate
a
certificate
with
the
IP
address
of
the
sending
device
(as
the
Common
Name)
and
enabled
for
use
in
secure
syslog
communication.
The
syslog
server
uses
this
certificate
to
verify
that
the
firewall
or
Panorama
is
authorized
to
communicate
with
the
syslog
server.
Use
the
following
steps
to
generate
the
certificate
on
the
firewall
or
Panorama:
1.
Select
Panorama
> Certificate Management > Certificates
.
2.
Click
Generate
to
create
a
new
certificate
that
will
be
signed
by
a
trusted
CA
or
the
self
‐
signed
CA.
3.
Enter
a
name
for
the
certificate.
4.
In
Common Name
,
enter
the
IP
address
of
the
device
sending
logs
to
the
syslog
server.
5.
Select
Shared
if
you
want
the
certificate
to
be
a
shared
certificate
on
Panorama
or
to
be
shared
by
all
virtual
systems
in
a
multiple
virtual
system
firewall.
6.
In
Signed by
,
select
the
trusted
CA
or
the
self
‐
signed
CA
that
is
trusted
by
both
the
syslog
server
and
the
sending
device.
7.
Click
Generate
.
The
certificate
and
the
keypair
will
be
generated.
8.
Click
the
link
with
the
name
of
the
certificate
and
enable
the
Certificate for Secure Syslog
check
box
for
secure
access
to
the
syslog
server.
9.
In
the
Certificates
page,
verify
the
certificate
details.
In
the
Usage
column,
verify
that
it
is
marked
as
Certificate
for
Secure
Syslog.
Step
3
(Only
for
Managed
Collectors)
On
Panorama,
select
the
certificate
to
use
for
secure
syslog
communication.
You
must
have
imported
the
trusted
CA
certificate
in
to
Panorama
or
generated
it
on
Panorama.
The
certificate
must
be
enabled
for
use
as
a
Certificate for
Secure Syslog
.
1.
Select
Panorama > Managed Collectors.
2.
Click
Add
to
add
a
new
Managed
Collector
or
select
the
link
to
edit
the
configuration
for
a
Managed
Collector.
3.
Select
General
,
and
choose
the
certificate
from
the
Certificate for Secure Syslog
drop
‐
down.
You
can
only
select
from
the
certificate
that
are
available
on
Panorama > Certificate Management >
Certificates
.
Step
4
Configure
Panorama
to
forward
logs.
To
forward
logs
for
your
platform/deployment,
see
Enable
Log
Forwarding
from
Panorama
to
External
Destinations
(Continued)
