Palo Alto M-100 modes

The M-100 appliance from  PaloAlto can run in 1 or 2 modes

•  Panorama 
•  log-collector

You can change the mode from default Panorama to log collector by issuing the following cli cmd;

request system logger-mode logger  . Once your in log-collector mode your access is only accepted via ssh ( no WebGUI )

Which mode you take depends on your security needs. Keep these thoughts in mind.

• Panorama mode can collect logs & conduct  management

• The log-collector  can collects for  more  than one firewall

• If you ever wanted to  restore a log-collector appliance back to panorama mode, you will loose your logs unless you back them up

• You can forward specific logs types ( i.e traffic or system or threats, or configs , or wildfire ,etc.....  )

•  Don't forget to enable log_forwarder for the fwpolicies you want to log for

• Have a plan on what you want to accomplish with logging and how much logging you need 

NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \