Palo Alto Networks Certified Network Security Engineer (PCNSE)Plan and DesignHard
A network architect is designing a log collection solution for a large enterprise with 50 Palo Alto Networks firewalls distributed across 10 data centers globally. Each firewall generates approximately 500 logs per second. The design requires a minimum of 90 days of log retention for all log types (traffic, threat, URL, data, wildfire). The architect also needs to ensure high availability for log collection and centralized management. Which log collection solution best meets these requirements?
- AConfigure each firewall to send logs directly to a single, centralized syslog server.
- BDeploy a dedicated Log Collector Group on Panorama, with multiple Log Collectors.
- CSend all logs to a cloud-based SIEM solution without any on-premise log collection.
- DUtilize local logging on each firewall and periodically export logs to an external storage.
Show answer & explanationAnswer & explanation
Correct answer: B. Deploy a dedicated Log Collector Group on Panorama, with multiple Log Collectors.
For large-scale deployments with high log volume, long retention, and high availability, a Panorama Log Collector Group with multiple Log Collectors is the optimal solution. This provides centralized management, scalability for log ingestion and storage, and redundancy.
Why the other options are wrong
- A. A single syslog server would struggle with the volume and lacks high availability, making it unsuitable for a large enterprise.
- C. While a cloud SIEM can be part of a solution, relying solely on it without on-premise collection might not meet all retention or immediate centralized management needs, especially for such a large scale, and doesn't explicitly guarantee high availability for the *collection* aspect itself without further design.
- D. Local logging and periodic export do not meet the real-time centralized management and high availability requirements.
Panorama Log Collector Group
A feature in Panorama that allows multiple Log Collectors to be grouped together to provide scalable, centralized, and highly available log collection and storage for Palo Alto Networks firewalls.
- Scales log ingestion and storage capacity.
- Provides redundancy for log collection.
- Enables centralized logging for multiple firewalls.
Memory trick: For big logs and high availability, the Panorama Log Collector Group is your best group effort.