HOW TO SECURE REMOTE ACCESS HOW TO

Virtual appliances, both firewalls and Panorama, support local storage expansion by having additional virtual disks added to enlarge their log capacity. Virtual machines, on the other hand, support having an additional disk added to them, which we will review in the next section. A production firewall may see up to 40 GB or more of logs being created daily, thus decreasing log retention to less than a day on smaller platforms. The log databases on the left represent logs that are the direct result of sessions or system events taking place the column on the right contains the summary databases that are used to compile larger datasets containing statistical data that can be used in reporting:ДЇigure 1.1 вЂ“ Logging and reporting settingsДЄs hardware platforms are somewhat limited in terms of their capacity for storing logs, the need to export logs for a longer log retention period may arise quite quickly. These quotas can be adjusted via the web interface by going to Device > Setup > Management > Logging and Reporting Settings, as shown in the following screenshot. System: Logs and Indexes: 11M Current Retention: 46 daysД¬onfig: Logs and Indexes: 21M Current Retention: 46 daysДЄs you can see, the traffic logs are only assigned 29% of the totally available log space on this particular firewall. Threat: Logs and Indexes: 24K Current Retention: 0 days Traffic: Logs and Indexes: 211M Current Retention: 46 days Threat: 15.00%, 2.358 GB Expiration-period: 0 days Traffic: 29.00%, 4.559 GB Expiration-period: 0 days You can review the current quotas with the following command: > show system logdb-quota The available disk space needs to be shared by all the different log databases, so it is worth reviewing how much space is allocated to each database and tweaking the quotas and expiration periods to optimize them for retention. Some of the larger hardware platforms may have a secondary hard disk for logging, and on VM firewalls, an additional disk can be installed post-deployment. In this example, /dev/sda8 is a partition on the local disk that's used to store logs. Use the following command to review filesystem usage statistics: > show system disk-spaceДЇilesystem Size Used Avail Use% Mounted on All logs related to PAN-OS live in the /opt/panlogs partition. They are only accessible via the command line and are included in a Tech Support file for troubleshooting. Log files for the system daemons reside in the root partition. Allocating log storageДЄll NGFW firewalls and Panorama Systems are built from a Linux operating system running proprietary PAN-OS on top. First, we will look at where and how logs are stored.

HOW TO SECURE REMOTE ACCESS HOW TO

You will also learn how to apply filters so that only specific types of events are forwarded, as well as how to ensure Log forwarding configuration is applied automatically. In this section, you will learn the steps required to ensure logs are forwarded to an external system. Troubleshooting logs and log forwarding.Forwarding logs to syslog, SMTP, and other options.Learning about Panorama and log collectors.Understanding log forwarding profiles and best practices.In this chapter, we are going to cover the following main topics: We will also cover how to troubleshoot forwarding issues and how to apply filters to forwarding profiles to specify which log events are forwarded. We will then review how logs can be forwarded to Panorama and log collectors, as well as how to leverage alternative log protocols such as syslog. You will learn how to set up the configuration and apply best practices when dealing with log forwarding. Logs can be forwarded to an external Security Incident and Event Management System ( SIEM) and can be used to create a range of alerts whenever an interesting event occurs. In this chapter, we will take a closer look at how to forward firewall logs to an external system and discuss some of the benefits.

How to secure remote access