Palo Alto Networks PAN-OS: send syslog, NetFlow and SNMP traps to MobiObs

Before you start

The MobiObs device is 10.20.4.9 in the examples; use the address on its Network screen. Android does not let apps listen on ports below 1024, and MobiObs uses the same ports on every platform, so use these destinations:

Steps are for the PAN-OS web interface on 10.2 and 11.x. By default the firewall sends syslog from its management interface, so the MobiObs device must be reachable from the management network, or you need a service route that sends syslog from a data-plane interface (Device > Setup > Services > Service Route Configuration). Nothing takes effect until you commit.

Syslog server profile

1. Go to Device > Server Profiles > Syslog and click Add. Name the profile, for example MOBIOBS.
2. On the Servers tab, add a server: a name, Server 10.20.4.9, Transport UDP or TCP, Port 5514, Format BSD or IETF, and a Facility (the default, LOG_USER, is fine).
3. Leave the Custom Log Format tab empty to send the standard comma-separated PAN-OS format, or define a CEF or LEEF format per log type if you prefer named fields. MobiObs extracts CEF and LEEF fields automatically.
4. Click OK.

TCP is the better choice for traffic logs, which arrive in bursts. A profile holds up to four servers, so you can add MobiObs next to a permanent collector without removing anything.

Choose which logs to send

Traffic, threat and URL logs are forwarded per security rule:

1. Go to Objects > Log Forwarding and add a profile, or edit the one your rules already use.
2. Add a match list for each log type you want, such as Traffic, Threat or URL Filtering. Leave the filter on All Logs, or narrow it, for example to one source address.
3. Under Syslog, add the MOBIOBS server profile.
4. In Policies > Security, open each rule you want to watch, and on the Actions tab select the log forwarding profile. For traffic logs, make sure Log at Session End is ticked.

System and configuration logs are forwarded from Device > Log Settings: add a match list under System (and Configuration, if you want to see commits), and add the MOBIOBS syslog profile to it. User-ID, HIP Match and correlation logs are configured in the same place.

Commit the configuration. To limit the load on the device, forward traffic logs from the few rules involved in the problem rather than from every rule.

NetFlow

1. Go to Device > Server Profiles > NetFlow and add a profile.
2. Set the Template Refresh Rate low while you work, for example 1 minute, and the Active Timeout to 1 minute. The defaults (30 minutes and 5 minutes) delay the first decoded flows.
3. Tick PAN-OS Field Types if you want App-ID and User-ID fields in the records. MobiObs keeps fields it does not map as attributes.
4. Add a server: a name, 10.20.4.9 and port 2055 (the default).
5. Under Network > Interfaces, open the interface to watch and select the profile as its Netflow Profile. Commit.

PAN-OS exports NetFlow version 9 for traffic entering the interface, which MobiObs decodes on udp/2055. On the PA-5200, PA-5400, PA-5500, PA-7000 and PA-7500 series, NetFlow cannot leave through the management interface, so a service route for NetFlow is required.

SNMP traps

The SNMP trap server profile (Device > Server Profiles > SNMP Trap) takes a manager address and a v2c community or v3 user, but has no port field: PAN-OS sends traps to udp/162. To receive them on MobiObs, point the profile at a relay or a host that translates udp/162 to 10.20.4.9:1162, as shown in the port 514 guide. Then add the trap profile to the same log forwarding profile or Log Settings match lists as the syslog profile, and commit.

On a PAN-OS firewall, syslog carries the same events as traps, and more, so syslog alone is usually enough.

Verify it works

• Logs. After the commit, the configuration log entry for the commit itself (if you forward configuration logs) and new system messages appear in Logs. Generate traffic through a rule with the forwarding profile; its traffic log appears when the session ends. Filter by the firewall’s host to see only PAN-OS messages.
• Flows. Once the template has arrived, Flows shows bytes over time and the top talkers and ports for traffic entering the chosen interface.
• Sources. Shows which address the firewall sends from: the management address or the service route’s interface.

PAN-OS CLI: checks

ping source 192.0.2.1 host 10.20.4.9
debug log-receiver statistics
debug log-receiver netflow statistics

Replace 192.0.2.1 with the interface address that syslog should leave from. The log-receiver statistics show whether logs are being forwarded and NetFlow records exported.

Troubleshooting

• Nothing arrives. Check the service route: by default syslog leaves from the management interface, which is often on a network the MobiObs device cannot reach.
• System logs arrive but no traffic logs. The security rule does not have the log forwarding profile, or logging at session end is off.
• Messages arrive slowly or in bursts. Use TCP, and forward from fewer rules.
• Flows arrive but show no data. Lower the template refresh rate; until a template arrives, NetFlow v9 records cannot be decoded.
• Nothing changed at all. The configuration has not been committed.

Remove it afterwards

Remove the MOBIOBS syslog profile from the log forwarding profile and from Log Settings, set the interface’s NetFlow profile back to none, delete the server profiles and commit. If you created a log forwarding profile only for this visit, remove it from the security rules first.