Cyfin - Palo Alto Firewall Support

New Release - Version 9.5.0 for Cyfin Now Available

• Upgrading from Cyfin v9.2.8 to v9.5.x
• Benefits of Upgrading to Cyfin VM

IMPORTANT NOTE: for 9.2.8 and earlier customers please contact support for upgrade.

Join our Early Adopter Program

Receive the latest solutions and have the opportunity to provide feedback directly to our development team. To learn more click here.

Cyfin - Palo Alto Firewall Configuration

Cyfin is installed on either a Windows or Linux server. Palo Alto logs are transfered to Cyfin either by syslog or FTP. See more instructions below.

Log File Setup

Log File Type:  Palo Alto Firewall

Palo Alto Networks Configuration Steps

The following steps are required to forward Palo Alto logs to Cyfin Syslog Server:

• Create a syslog server profile.
• Configure a log forwarding profile to select the logs to be forwarded to Cyfin syslog server.
• Assign the log forwarding profile to security rules.

The logs that must be forwarded are the Threat logs with Informational severity. Informational Threat logs include URL Filtering, Data Filtering, and WildFire logs.

Syslog Server Profile

1. In your Palo Alto Firewall user interface, go to Device – Server Profiles – Syslog.
2. Click Add at the bottom of the screen.
3. Enter the following information:
   • Name – Cyfin
   • Syslog Server – IP address of where Cyfin is installed
   • Transport – UDP
   • Port – 1455
   • Format – BSD
   • Facility – LOG_USER
4. Click OK to save the server profile.
5. Click Commit at the top of the screen to commit the change.

Log Forwarding Profile

1. Go to Objects – Log Forwarding.
2. Select the syslog server profile (Log-Forwarding-Profile) for forwarding Threat logs to Cyfin.
3. In the Threat drop-down field, ensure that for the Severity Informational option, Cyfin is selected in the Syslog column.
4. To forward URL Filtering logs, add Log Type “URL” and set Severity to “Informational.” Then set Syslog to “Cyfin.”
5. To forward Traffic logs, add Log Type “Traffic” and set Severity to “Informational.” Then set Syslog to “Cyfin.”
6. Click Commit at the top of the screen to commit the change.

URL Filtering Profile

To log the traffic from URL Filtering logs, you may need to adjust the Site Access for each allowed URL category.

1. Go to Objects – URL Filtering – URL Filtering Profile.
2. Select Categories – Site Access.
3. Filter by “Allow.”
4. Change “Allow” to “Alert” for each category listed.

Security Policy Rule

1. Go to Policies – Security.
2. Select the rule for which the log forwarding needs to be applied.
3. Apply the security profile to the rule.
4. Go to Actions and in the Log Forwarding drop-down field, select the log forwarding profile.
5. Click OK. By default, when Threat logs are forwarded to Cyfin Syslog Server, the logs will have several fields including source IP address, destination IP address, and URL.
6. Click Commit at the top of the screen to commit the change.

Now, you can configure Cyfin to write the forwarded Palo Alto log files to syslogYYYYXXXX.txt files.

Cyfin Configuration Steps

Cyfin Syslog Server listens for syslog messages from your Palo Alto device. Both UDP-based and TCP-based messages are supported.

1. Select the Palo Alto Firewall log file configuration in Cyfin for your Palo Alto device.
2. Specify the Directory in which the log files will be created. The default directory is [InstallPath]\wc\cf\log.
3. Select Enable Syslog Server.
4. For Port Type, select UDP or TCP for the Internet protocol you want to use.
5. In the Listening Port field, the default port number is 1455. The listening port will be used by your Palo Alto device to transfer the data. You may change this number if necessary.
6. At your Palo Alto device, specify the IP address of the Cyfin server and the listening port, and submit the syslog messages.
7. Your log files will be created and displayed in the Log File Viewer in Cyfin.
8. If you have many of the same Palo Alto devices, use one log file configuration with one listening port, and point each Palo Alto device to the same listening port.