Syslog destination is sent without TLS
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
Log records over UDP or plain TCP cross the network readable by anyone on the path, and over UDP a record that is lost is lost silently. The records name users, addresses and configuration changes.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Change the transport of each listed server to SSL, and confirm the collector accepts TLS on the port it listens on.
- Import the collector's issuing certificate authority so the firewall can verify the collector.
- Keep a UDP destination only where the collector cannot take TLS, and record why.
Command line
PAN-OS CLI
set shared log-settings syslog <object-name> server <server-name> transport SSLset shared log-settings syslog <object-name> server <server-name> port 6514
An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.
Read it back
show shared log-settings syslog <object-name>Values to fill in2
- <object-name>
- The object's name, as it appears on your firewall
- <server-name>
- The server entry's name
Before you type it1
- Syslog over TLS needs a certificate profile the collector accepts.
How to confirm the fix
- Confirm each server in the profile shows the SSL transport.
- Confirm the collector receives records after the change, from the collector itself.
Limits
- A destination whose transport the file does not state is counted as unknown, not as UDP.
Compliance references
No benchmark recommendation is mapped to this control in this version.
More in Logging and Integrations
- PAN-SEC-030Syslog forwarding missing
- PAN-SEC-032SNMP v2c is enabled
- PAN-SEC-075System or configuration logs are forwarded nowhere
- PAN-SEC-076SNMP trap profile uses SNMP v2c
- PAN-SEC-077SNMP answers on management with no permitted IP list
- PAN-SEC-079Log server profile is referenced by no log setting
- PAN-SEC-117No log entry when the data plane is fully loaded
- PAN-SEC-161Log forwarding profile does not forward traffic or threat logs
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.