{"id":2690,"date":"2022-04-13T16:58:11","date_gmt":"2022-04-14T00:58:11","guid":{"rendered":"https:\/\/tungle.ca\/?p=2690"},"modified":"2022-04-15T13:23:54","modified_gmt":"2022-04-15T21:23:54","slug":"send-palo-alto-logs-on-prem-to-splunk-on-aws-via-vpn-site-to-site","status":"publish","type":"post","link":"https:\/\/tungle.ca\/?p=2690","title":{"rendered":"Send Palo Alto logs on-prem to Splunk on AWS via VPN site-to-site"},"content":{"rendered":"\n<p>This is a diagram that I have used to deploy this lab.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"569\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-212-1024x569.png\" alt=\"\" class=\"wp-image-2691\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-212-1024x569.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-212-300x167.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-212-768x427.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-212-1536x854.png 1536w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-212-2048x1139.png 2048w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-212-200x111.png 200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>We need to deploy a VPN site to site between Palo Alto on-prem and AWS.<\/p>\n\n\n\n<p>On AWS.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"597\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-4-1024x597.png\" alt=\"\" class=\"wp-image-2692\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-4-1024x597.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-4-300x175.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-4-768x447.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-4-200x117.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-4.png 1392w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>On Palo Alto.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"769\" height=\"392\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-214.png\" alt=\"\" class=\"wp-image-2699\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-214.png 769w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-214-300x153.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-214-200x102.png 200w\" sizes=\"auto, (max-width: 769px) 100vw, 769px\" \/><\/figure>\n\n\n\n<p>Pings Splunk instance (10.0.0.110) via ethernet 1\/2 interface.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"605\" height=\"326\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-220.png\" alt=\"\" class=\"wp-image-2705\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-220.png 605w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-220-300x162.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-220-200x108.png 200w\" sizes=\"auto, (max-width: 605px) 100vw, 605px\" \/><\/figure>\n\n\n\n<p>The VPN site-to-site tunnel is up in Palo Alto.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"883\" height=\"642\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-5.png\" alt=\"\" class=\"wp-image-2693\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-5.png 883w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-5-300x218.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-5-768x558.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-5-200x145.png 200w\" sizes=\"auto, (max-width: 883px) 100vw, 883px\" \/><\/figure>\n\n\n\n<p>Set up a new Windows 2016 instance with 4 GB memory to run Splunk Enterprise on AWS.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"568\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-222-1024x568.png\" alt=\"\" class=\"wp-image-2707\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-222-1024x568.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-222-300x167.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-222-768x426.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-222-200x111.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-222.png 1454w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>RDP to the instance and install Splunk Enterprise. Then, add Splunk for Palo Alto on this instance.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"608\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-223-1024x608.png\" alt=\"\" class=\"wp-image-2708\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-223-1024x608.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-223-300x178.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-223-768x456.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-223-200x119.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-223.png 1081w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Configure Splunk to get Palo Alto logs via UDP port 514.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"387\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-213-1024x387.png\" alt=\"\" class=\"wp-image-2695\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-213-1024x387.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-213-300x113.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-213-768x290.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-213-200x76.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-213.png 1078w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Check the UDP 514 port is running on the Splunk instance.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"803\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-3.png\" alt=\"\" class=\"wp-image-2694\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-3.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-3-300x235.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-3-768x602.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-3-200x157.png 200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Go to Palo Alto, and configure Syslog to send logs to Splunk.<\/p>\n\n\n\n<p>By default, Palo Alto uses a management interface to send logs. We need to change the interface to allow Palo Alto to send logs via ethernet1\/2 (LAN interface).<\/p>\n\n\n\n<p>Log on PA console, type configure, and the command below to change the interface to send logs.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>set deviceconfig system route service syslog source interface e1\/2<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"855\" height=\"562\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-6.png\" alt=\"\" class=\"wp-image-2696\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-6.png 855w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-6-300x197.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-6-768x505.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-6-200x131.png 200w\" sizes=\"auto, (max-width: 855px) 100vw, 855px\" \/><\/figure>\n\n\n\n<p>Also, we can go to Device &#8211; Setup &#8211; Service Route Configuration &#8211; Syslog. Configure the source interface and source IP address like the following screenshot.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"734\" height=\"438\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-218.png\" alt=\"\" class=\"wp-image-2703\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-218.png 734w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-218-300x179.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-218-200x119.png 200w\" sizes=\"auto, (max-width: 734px) 100vw, 734px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"738\" height=\"594\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-217.png\" alt=\"\" class=\"wp-image-2702\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-217.png 738w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-217-300x241.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-217-200x161.png 200w\" sizes=\"auto, (max-width: 738px) 100vw, 738px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"881\" height=\"640\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-7.png\" alt=\"\" class=\"wp-image-2697\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-7.png 881w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-7-300x218.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-7-768x558.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-7-200x145.png 200w\" sizes=\"auto, (max-width: 881px) 100vw, 881px\" \/><\/figure>\n\n\n\n<p>Configure Syslog on Palo Alto.<\/p>\n\n\n\n<p>IP address: 10.0.0.110 (Splunk instance)<\/p>\n\n\n\n<p>Port: 514 UDP<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"831\" height=\"509\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-8.png\" alt=\"\" class=\"wp-image-2698\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-8.png 831w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-8-300x184.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-8-768x470.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/Splunk-8-200x123.png 200w\" sizes=\"auto, (max-width: 831px) 100vw, 831px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"910\" height=\"591\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-215.png\" alt=\"\" class=\"wp-image-2700\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-215.png 910w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-215-300x195.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-215-768x499.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-215-200x130.png 200w\" sizes=\"auto, (max-width: 910px) 100vw, 910px\" \/><\/figure>\n\n\n\n<p>Log off and enter the wrong password on Palo Alto. Log back into Palo Alto to generate logs to send to Splunk.<\/p>\n\n\n\n<p>We can see &#8220;failed authentication log&#8221; events have been generated on Splunk.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"798\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-216-1024x798.png\" alt=\"\" class=\"wp-image-2701\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-216-1024x798.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-216-300x234.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-216-768x599.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-216-200x156.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-216.png 1074w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p> <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"756\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-219-1024x756.png\" alt=\"\" class=\"wp-image-2704\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-219-1024x756.png 1024w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-219-300x222.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-219-768x567.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-219-200x148.png 200w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-219.png 1078w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1023\" height=\"739\" src=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-221.png\" alt=\"\" class=\"wp-image-2706\" srcset=\"https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-221.png 1023w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-221-300x217.png 300w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-221-768x555.png 768w, https:\/\/tungle.ca\/wp-content\/uploads\/2022\/04\/image-221-200x144.png 200w\" sizes=\"auto, (max-width: 1023px) 100vw, 1023px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>This is a diagram that I have used to deploy this lab. We need to deploy a VPN site to site between Palo Alto on-prem and AWS. On AWS. On Palo Alto. Pings Splunk instance (10.0.0.110) via ethernet 1\/2 interface. The VPN site-to-site tunnel is up in Palo Alto. Set up a new Windows 2016 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19,21,11],"tags":[20,18,13],"class_list":["post-2690","post","type-post","status-publish","format-standard","hentry","category-cloud","category-palo-alto","category-security","tag-cloud","tag-palo-alto","tag-security"],"_links":{"self":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2690","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2690"}],"version-history":[{"count":4,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2690\/revisions"}],"predecessor-version":[{"id":2880,"href":"https:\/\/tungle.ca\/index.php?rest_route=\/wp\/v2\/posts\/2690\/revisions\/2880"}],"wp:attachment":[{"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tungle.ca\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}