Reporter for Palo Alto Networks

Installation guide

Fastvue Reporter can be up and running in as little as five minutes following this simple installation guide.

Minimum Server Requirements

Download Fastvue Reporter and install on a machine (or virtual machine) that meets our recommended requirements below.

Installation

Note: Fastvue Reporter is a resource intensive application by design in order to import data and run reports as fast as possible. We do not recommend installing Fastvue Reporter on a server that provides a critical network service such as a Domain Controller, DNS server, or DFS server. We recommend installing on a dedicated VM (virtual machine) so you can scale the resources appropriately.

To install Fastvue Reporter:

  1. Double-click the downloaded setup exe on a machine that meets the above requirements.

  2. The installer automatically installs and configures the required pre-requisites which include .Net 4.6 and IIS (Web Server and Application Server roles). It will also install Open JDK and Elasticsearch in its own self-managed directory.

  3. Once the pre-requisites have been installed, proceed through the installation wizard. It will ask you for:

    • Installation folder
      Only application files are installed to this folder and it does not require much disk space. The default is C:\Program Files\Fastvue\{Product Name}.

    • Website and Virtual Directory
      This is the website and sub-folder (virtual directory) within IIS to install the Fastvue Reporter website into. The default is Default Web Site.

      If you have other websites installed on your server, it is a good idea to either create a new website in IIS first and install to that, or use the 'sub-directory' option and enter a name such as ‘fastvue’ or ‘reports’. This creates a contained 'virtual directory' in IIS under the main website which you can access using http://yourserver/fastvue (for example).

    • Data Location
      This is the location where all imported data, configuration and report files are stored. Specify a location with plenty of disk space. The default is C:\ProgramData\Fastvue\{Product Name}.

Automated / Silent Deployment

If you need to deploy Fastvue Reporter to silently or to multiple organizations in an automated way, please see our comprehensive Reporter 4.0 PowerShell script.

Configure Palo Alto Networks Syslog Settings

Now that Fastvue Reporter for Palo Alto Networks has been installed, you need to configure your Palo Alto Networks firewall(s) to send syslog data to the Fastvue server.

This can be done directly on each Palo Alto Networks firewall, or using Panorama.

Individual Palo Alto Networks firewalls

Panorama

Set URL Filtering Categories to Block or Alert

To ensure traffic to all URL Categories is logged:

  1. Go to Objects | URL Filtering and either edit your existing URL Filtering Profile or configure a new one.

  2. Ensure all categories are set to either Block or Alert (or any action other than none).

Configuring Palo Alto firewall's URL Filtering Categories to Block or Alert

Disable “Log Container Page Only” and Enable HTTP Header Logging

We recommend disabling the Log Container Page Only option in order to log all URLs. Fastvue Reporter's Site Clean technology will group URLs into the container page for simplified reporting without losing any bandwidth details, images, or granularity.

HTTP Header logging enables the logging of the Referer field which is valuable information for Fastvue’s Site Clean technology.

To do this:

  1. Go to Objects | Security Profiles | Settings 

  2. Check the User-AgentReferer, and X-Forwaded-For checkboxes under HTTP Header.

  3. Uncheck the Log Container Page Only checkbox.

Configure HTTP Header Logging in Palo Alto firewall

Commit the changes

Don’t forget to commit your settings changes! Your Palo Alto Networks firewall should now be sending the Fastvue Reporter server the URL, Threat, Traffic and Wildfire log data.

Add a Source

Add your firewall as a Source in Fastvue Reporter. This can be done on the start page that is presented after installation, or by going to Settings | Sources and clicking Add Source.

If your firewall is sending syslog data on port 514, click into the dropdown and wait a few seconds. The dropdown will populate with the name and/or IP of the device(s) sending syslog traffic to the Fastvue Server. Simply select your firewall from the list and click Add Source.

If your firewall is sending syslog data on a different port (not 514), Fastvue Reporter will not automatically display your firewall in the dropdown list. In this case, manually enter your firewall's IP and your selected syslog port into the options provided, then click Add Source.

Note: If entering your firewall and port manually, make sure the IP is the one your Fastvue Server is receiving syslog data from. This could be the IP of the internal LAN interface on your firewall, or if you have intermediate devices routing syslog traffic, it could be the interface IP of the last hop.

If you're unsure, you can a 'dummy' source with an invalid name (such as 'dummy') but specify the custom syslog port your firewall is sending syslog data on. Fastvue Reporter will then start listening on the port specified. You can then click Add Source again, and the dropdown list should populate with any device sending syslog data on your custom syslog port.

It may take 10-20 seconds before the first records are imported. You can watch the records and dates imported in Settings | Sources. Once records start importing, you can go to the Dashboard tab to see your network traffic.

Enjoy

Now you can try out the many features of Fastvue Reporter!