Palo AltoConfig0 downloads

Palo Alto PAN-OS SNMP v3 and Syslog

SNMPv3 with an authentication/privacy user, syslog server profiles, log forwarding profiles attached to security rules, and NTP - including the detail that traffic logs only forward when a rule references the profile.

↓ example.txt

What is it?

SNMP and syslog give you the two views of a Palo Alto firewall: polled counters and pushed events. PAN-OS differs from most platforms in how syslog is wired. There are two distinct objects. A syslog server profile says WHERE logs go - the collector address, transport and port. A log forwarding profile says WHAT gets forwarded, and it must then be attached to individual security rules. System and configuration logs forward on their own, but traffic, threat and URL logs stay on the firewall until a rule references the log forwarding profile. A firewall can therefore be fully configured for syslog and still send no traffic logs at all.

When to use

·Every PAN-OS firewall at deployment, as part of the base build
·Forwarding threat and URL logs to a SIEM - this is usually the whole point of running the NGFW
·Configuration auditing: PAN-OS config logs record every commit with the administrator who made it
·Capacity planning: session count, throughput and dataplane CPU polled over time predict when the platform needs upgrading
·Alerting on HA state changes and certificate expiry, which arrive as system logs

When NOT to use

·SNMPv2c on an internet-facing management interface - the community string is cleartext
·Forwarding all traffic logs over UDP from a high-throughput firewall. UDP drops silently under load, so the logs you most need during an incident are exactly the ones most likely to be missing. Use TCP or SSL where volume is high
·Forwarding `All Logs` for traffic without estimating volume first - a busy firewall generates enormous quantities and SIEM licensing is usually billed on it
·Instead of Panorama in a multi-firewall estate. Panorama aggregates logs natively and provides correlation that plain syslog cannot
·Relying on local log storage for retention. PAN-OS log partitions are finite and roll over, sometimes faster than expected under load

How it compares

vs Fortinet FortiOS SNMP/SyslogFortiOS filters globally per syslog target with `config log syslogd filter`. PAN-OS attaches a log forwarding profile per security rule, so logging is decided rule by rule. PAN-OS gives finer control and a correspondingly easier way to forget: a rule without the profile silently forwards nothing.

vs Cisco ASA SNMP/SyslogThe ASA logs everything matching its global `logging` configuration with no per-rule concept. PAN-OS requires the per-rule attachment for traffic logs. Engineers coming from ASA routinely configure the syslog profile, see system logs arriving, and assume traffic logs are working too.

vs PanoramaPanorama receives logs natively with full structure, provides correlation across firewalls, and manages log forwarding configuration centrally. Syslog to a SIEM is still common alongside it, but if Panorama is deployed it should be the primary destination.

vs Juniper JunOS SNMP/SyslogJunOS has one syslog configuration under `system syslog` that applies device-wide. PAN-OS splits destination from content and ties content to policy. The PAN-OS model is more granular; the JunOS model is harder to get subtly wrong.

Prerequisites

→Management interface reachable to the NMS and the syslog collector
→NTP configured first - SNMPv3 authentication is time-sensitive and timestamps must be correct
→Security rules already defined, since the log forwarding profile has to be attached to them
→SNMPv3 credentials stored in a secrets manager, not in the repository
→An estimate of log volume before enabling traffic log forwarding, and a decision on UDP versus TCP

Config Generator

Hostname *

SNMP Location

SNMP Contact

SNMPv3 View Name

SNMPv3 Username *

SNMPv3 Auth Password *

SHA authentication. Never commit the real value

SNMPv3 Privacy Password *

AES encryption. Use a different value from the auth password

Syslog Server Profile Name *

Primary Syslog Server *

Secondary Syslog Server

Transport

UDP, TCP or SSL. TCP and SSL survive restarts without losing messages

Syslog Port

Log Forwarding Profile Name *

This is what security rules reference. Without it, traffic logs stay on the firewall

Management Interface IP

Used as the syslog source address so the collector sees a stable sender

Primary NTP Server *

Secondary NTP Server

Timezone

Verification commands

show system info | match snmp

Confirm the SNMP service is enabled on the management interface

ExpectedSNMP shown as enabled. If the management interface profile disables it, polls never reach the agent regardless of the SNMP configuration.

show log system direction equal backward | match syslog

Check for syslog delivery errors in the system log

ExpectedNo connection errors. Messages about an unreachable syslog server point to routing or firewall problems between the management interface and the collector.

show logging-status

Show log forwarding state and counters per destination

ExpectedCounts of logs forwarded and any that failed. This is the quickest way to tell whether the firewall believes it is sending anything at all.

show ntp

Confirm NTP synchronisation before trusting any timestamp

ExpectedSynchronised status against the configured server. PAN-OS will not authenticate SNMPv3 reliably with significant clock skew.

Debug commands

tail follow yes mp-log ms.log

Watch management plane logging in real time while reproducing an issue

WarningVerbose. Stop with Ctrl-C. This is a management plane log and does not show dataplane traffic processing.

debug log-receiver statistics

Show detailed log receiver and forwarding statistics, including drops

WarningOutput is long and version-dependent. Useful for confirming whether logs are being generated but not forwarded, which distinguishes a policy problem from a transport problem.

test log-forwarding profile <name>

Send a test message through a log forwarding profile

WarningConfirms the profile and the syslog server profile resolve correctly. It does NOT confirm that any security rule references the profile, which is the more common failure.

Common mistakes & fixes

SymptomSystem logs arrive at the SIEM but traffic logs never do

CauseThe log forwarding profile is not attached to any security rule

FixThis is the PAN-OS-specific trap, and the reason this template documents it twice. System and config logs forward from the `log-settings system` match list on their own; traffic logs require `set rulebase security rules <RULE> log-setting <PROFILE>` on each rule. Check with `show running security-policy | match log-setting`.

SymptomTraffic logs are forwarded for some sessions but not others

CauseRules have `log-start` set rather than `log-end`, or some rules lack the log setting entirely

FixPrefer `log-end yes` - it records the complete session including byte counts, where log-start records only that a session began. Audit all rules rather than assuming the default; a rule added later without the profile is the usual cause.

SymptomLogs arrive with gaps under heavy load

CauseUDP transport dropping messages when the collector or network is saturated

FixSwitch the syslog server profile to TCP or SSL. UDP loses messages silently, and under load is exactly when the logs matter most. Verify the collector accepts TCP on the configured port first.

SymptomSNMPv3 polling fails while the device is reachable

CauseView not assigned to the user, or an auth/privacy protocol mismatch with the NMS

FixPAN-OS requires the user to reference a view that includes the OID subtree - without it the user authenticates but reads nothing. Confirm both ends agree on SHA and AES, and that the NMS is configured for authPriv rather than authNoPriv.

SymptomThe collector shows the firewall under different source addresses

CauseNo fixed source address set on the syslog server profile

FixSet `ipaddr` on the server entry to the management interface address. Many collectors key on source address for device identity, and a varying source breaks dashboards and correlation rules.

Further learning

Recommended books to go deeper on this topic.

CCNP Enterprise Core ENCOR 350-401 Official Cert Guide

Brad Edgeworth et al. · Cisco Press · Network management: SNMP v1/v2c/v3, syslog levels, NTP, NetFlow

Kindle ↗Hardcover ↗