©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
145
Manage
Log
Collection
Log
Collection
Deployments
Step
2
Perform
this
step
for
all
the
firewalls
that
will
forward
logs
to
Panorama.
1.
If
you
have
not
already,
perform
the
initial
setup
of
each
firewall
that
you
will
assign
to
a
Log
Collector.
For
details,
refer
to
the
.
2.
In
the
Panorama
web
interface,
select
Panorama > Managed
Devices
,
click
Add
,
enter
the
serial
number
of
each
firewall
(one
line
per
serial
number),
then
click
OK
.
Step
3
Assign
the
firewalls
to
device
groups
and
templates.
This
step
is
a
prerequisite
to
enabling
log
forwarding
to
Panorama.
Use
the
Panorama
web
interface
to
perform
the
following
tasks:
1.
.
2.
Step
4
. Use
the
Panorama
web
interface
to
configure
log
forwarding.
The
specific
tasks
depend
on
the
log
types:
•
Traffic,
threat,
and
WildFire
logs:
a.
Select
the
device
group
you
just
added.
b.
Select
Objects > Log Forwarding
and
click
Add
.
c.
Enter
a
Name
for
the
Log
Forwarding
Profile,
select
the
Panorama
check
boxes
for
the
desired
log
types,
then
click
OK
.
d.
Assign
the
log
forwarding
profile
to
the
desired
rules.
For
example,
select
Policies > Security
,
select
the
rule,
in
the
Actions
tab
select
the
Log Forwarding
profile
you
just
added,
then
click
OK
.
•
System:
a.
Select
the
template
you
just
added.
b.
Select
Device > Log Settings > System
and
select
the
Severity
level.
c.
Select
the
Panorama
check
box
and
click
OK
.
•
Config:
a.
Select
the
template
you
just
added.
b.
Select
Device > Log Settings > Config
and
click
the
Edit
icon.
c.
Select
the
Panorama
check
box,
then
click
OK
.
Step
5
(Optional)
This
step
applies
to
logs
that
the
Panorama
virtual
appliances
generate
(system
and
config
logs)
and
logs
that
the
firewalls
generate
(system,
config,
HIP
match,
traffic,
threat,
and/or
WildFire
logs).
Use
the
Panorama
web
interface
to
perform
the
following
steps:
1.
Create
one
or
more
server
profiles,
depending
on
the
external
services
to
which
you
will
forward
logs:
•
SNMP:
Panorama > Server Profiles > SNMP Trap
•
Syslog:
Panorama > Server Profiles > Syslog
•
Email:
Panorama > Server Profiles > Email
2.
Select
Panorama > Log Settings
and
select
the
type
of
log
you
want
to
forward:
System
,
Config
,
HIP Match
,
Traffic
,
Threat
,
and/or
WildFire
.
3.
Assign
the
server
profiles
you
configured.
For
System
and
Threat
logs,
assign
profiles
for
each
desired
Severity
level.
For
WildFire
logs,
assign
profiles
for
each
Verdict
(
benign
and/or
malicious
).
For
Config
,
HIP Match
,
and
Traffic
logs,
click
the
Edit
icon
to
assign
server
profiles.
Deploy
Panorama
Virtual
Appliances
with
Local
Log
Collection
(Continued)
