About the Illumio and Palo Alto Networks Next-Generation Firewall (NGFW) Integration
The Illumio integration with Palo Alto Networks NGFW allows organizations to collect and analyze firewall logs to enhance visibility, drive segmentation decisions, and improve their security posture. This integration combines Palo Alto Networks' native log-export capabilities and Illumio's real-time traffic visibility to allow security teams to make data-driven policy decisions.
There are two supported methods to send Palo Alto Networks logs to Illumio: directly from Palo Alto Networks or from Cribl.
Note
You must enable syslog monitoring for both methods of sending Palo Alto Networks logs.
Forward logs directly from the Palo Alto Networks Panorama instance to the Illumio Syslog Service using mTLS and then onboard these logs using the Log Exporter.
For customers who are using Cribl, you have the option to send logs directly from Cribl to the Illumio-hosted Azure Event Hub. The Cribl method is supported for select customers only, so contact Illumio Support if you want to use this method. See Enable Cribl to Send Palo Alto Networks Firewall Logs to Azure Event Hub.
Understanding the Integration Workflow
Before you begin, review the prerequisites.
See Prerequisites for the Illumio and Palo Alto Networks NGFW Integration.
Configure Syslog monitoring.
See the Palo Alto Network documentation on how to configure syslog monitoring.
Onboard the connector.
See Onboard the Palo Alto Networks Connector with the Log Exporter.
Enable Cribl.
See Enable Cribl to Send Palo Alto Networks Firewall Logs to Azure Event Hub.
Format Syslog messages in CEF.
Add the connector.
After you have added the API connectore, review the CEF fields required to view the firewall traffic logs that are sent to Illumio Insights.