Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- pantag action to multiple firewall cluster
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello, How can i push ip addresses (pantag) to multiple firewalls on one search call.
I have 3 different firewall clusters and when i have ip address on my splunk search i would like to push that ip address to multiple firewalls.
For example; Can i have a static config when i say device=border-firewalls command will actually run on multiple firewalls?
Or Can i run multiple pantag commands back to back on one search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello! IP address tags use the same system in the firewall as User-ID mappings, so, ever since PAN-OS 8.0 you can redistribute the IP tags between firewalls the same way as users. Basically, you tell all the firewalls to share user/tag mappings, then tag the IP addresses on the main User-ID Agent firewall (or Panorama). The tag will automatically be redistributed to all other firewalls you've configured to receive it. This way, Splunk only needs to connect to one Firewall or Panorama to effectively create a new tag on all firewalls.
More information:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello! IP address tags use the same system in the firewall as User-ID mappings, so, ever since PAN-OS 8.0 you can redistribute the IP tags between firewalls the same way as users. Basically, you tell all the firewalls to share user/tag mappings, then tag the IP addresses on the main User-ID Agent firewall (or Panorama). The tag will automatically be redistributed to all other firewalls you've configured to receive it. This way, Splunk only needs to connect to one Firewall or Panorama to effectively create a new tag on all firewalls.
More information:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you that did the trick
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great! Glad to hear it!
Fastest way to demo Observability
September Community Champions: A Shoutout to Our Contributors!
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
