Sunday, November 22, 2015

Palo Alto M-100 modes

The M-100 appliance from  PaloAlto can run in 1 or 2 modes

  •  Panorama 
  •  log-collector

You can change the mode from default Panorama to log collector by issuing the following cli cmd;

request system logger-mode logger  . Once your in log-collector mode your access is only accepted via ssh ( no WebGUI )

Which mode you take depends on your security needs. Keep these thoughts in mind.

  • Panorama mode can collect logs & conduct  management
  • The log-collector  can collects for  more  than one firewall
  • If you ever wanted to  restore a log-collector appliance back to panorama mode, you will loose your logs unless you back them up
  • You can forward specific logs types ( i.e traffic or system or threats, or configs , or wildfire ,etc.....  )

  •  Don't forget to enable log_forwarder for the fwpolicies you want to log for
  • Have a plan on what you want to accomplish with logging and how much logging you need 

NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
        /  \

No comments:

Post a Comment