Skip to main content

​
Set up the Wirespeed forwarder

  1. Follow the shared Log Forwarders guide to add Palo Alto Networks NGFW and open Forwarder Details
  2. Copy the hostname or IP address and listener port shown by Wirespeed
  3. Keep Forwarder Details available while configuring PAN-OS

​
Create a PAN-OS syslog server profile

  1. Sign in to the firewall or Panorama:
    • On a firewall, go to Device > Server Profiles > Syslog
    • In Panorama, select the template or template stack for the managed firewalls, then go to Device > Server Profiles > Syslog
  2. Click Add, name the profile, and select its virtual-system location when applicable
  3. Add a syslog server and enter the Wirespeed hostname or IP address and port
  4. Choose the transport configured in Wirespeed:
    • TCP provides reliable cleartext delivery
    • SSL provides reliable encrypted delivery using TLS 1.2
    • UDP provides connectionless cleartext delivery
  5. Select IETF format when available. Its timezone-aware header provides a safer timestamp fallback than BSD format
  6. Select the facility your organization uses, then save the server profile
Leave Custom Log Format unset for every forwarded log type. Wirespeed parses Palo Alto’s standard positional CSV layouts; selecting, reordering, or adding custom fields changes those layouts.
For SSL transport, follow the Wirespeed Syslog over TLS guidance. Wirespeed authenticates itself to the firewall with its server certificate but does not request a client certificate from the firewall. Do not enable SSL client authentication.

​
Choose which logs to forward

You control which PAN-OS log categories Wirespeed receives. You can forward all supported categories, only categories such as Traffic, Threat, or URL Filtering, or a filtered subset of each category.

​
Policy-generated logs

  1. Go to Objects > Log Forwarding. In Panorama, first select the device group for the managed firewalls
  2. Add a Log Forwarding profile
  3. Add one match-list entry for each desired log type, such as:
    • Traffic
    • Threat
    • URL Filtering
    • Data Filtering
    • WildFire Submissions
    • Authentication
    • Tunnel Inspection
    • GTP
    • SCTP
  4. Select the Wirespeed syslog server profile for each entry
  5. Optionally add a Palo Alto filter to restrict that log type by severity, verdict, zone, rule, or another available log attribute
  6. Attach the Log Forwarding profile to the applicable Security, Authentication, Decryption, DoS Protection, and Tunnel Inspection policy rules
  7. For Traffic logs, enable Log at Session Start, Log at Session End, or both according to your monitoring requirements

​
Device-generated logs

Go to Device > Log Settings and select the Wirespeed syslog server profile for the desired System, Config, User-ID, HIP Match, Correlation, IP-Tag, GlobalProtect, and Audit log settings available in your PAN-OS release. In Panorama, configure these settings in the template or template stack for the managed firewalls.
Wirespeed supports the standard Traffic, Threat, URL Filtering, Data Filtering, WildFire, HIP Match, GlobalProtect, IP-Tag, User-ID, Decryption, Tunnel Inspection, SCTP, Config, Authentication, System, Correlated Events, GTP, and Audit syslog layouts. You do not need to enable every type.

​
Commit and verify

  1. Deploy the PAN-OS configuration:
    • On a firewall, select Commit
    • In Panorama, select Commit > Commit and Push and include the affected device groups and templates
  2. Generate an event for each enabled category
  3. Confirm that events appear under Events in Wirespeed
See Palo Alto’s official Configure Syslog Monitoring, Configure Log Forwarding, and Syslog Field Descriptions documentation for PAN-OS-version-specific details.