PAN-OS Log Forwarding Setup And Configuration

This playbook sets up and maintains log forwarding for the Panorama rulebase. It can be run when setting up a new instance, or as a periodic job to enforce log forwarding policy. You can either update all rules and override previous profiles, or update only rules that do not have a log forwarding profile configured.

PAN-OS by Palo Alto Networks · 11 tasks · 5 inputs · 0 outputs

Inputs

  • log-forwarding-name — The name of the log-forwarding object that will be attached to all of the rules.
  • auto_commit — Should the rule be committed automatically or manually?
  • pre-post-rulebase — Either the pre-rulebase or post-rulebase, depending on the rule structure.
  • device-group — The device group to work on.
  • override-existing-profiles — Should we override log-forwarding profiles that were already defined.

Commands used

pan-os-edit-rule pan-os-list-rules

Flowchart

no yes yes yes Start Start Done Done List Rules - pan-os-list-rules List Rules pan-os-list-rules Add log forwarding profile to all rules - pan-os-edit-rule Add log forwarding profil... pan-os-edit-rule Is auto-commit defined? - AreValuesEqual Is auto-commit defined? AreValuesEqual Manually commit Manually commit PAN-OS Commit Configuration - PAN-OS Commit Configuration PAN-OS Commit Configuration PAN-OS Commit Configuration Should we override existing log forwarding profile? Should we override existi... Add log forwarding profile to rules that don't have it - pan-os-edit-rule Add log forwarding profil... pan-os-edit-rule Set security rules to context - Set Set security rules to con... Set Are there rules without a log forwarding profile configured? Are there rules without a...