palo alto bulk add log forwarding profile to security policy rules

You can use the migration tool to do this 

After version 10.1 there is also a log forwarding for security services policy optimizer under 

Policies > Security 

Policy optimizer in the bottom left

You need to have configured logging and your log forwarding profile in advance

Select "None" to find all the rules with no logging policy applied 

click the first rule

scroll to the bottom

hold shift and click the last rule to select all

In the bottom left click "Attach log forwarding profile"

Select your profile "LOG-FWD-PROFILE"

Click ok

Commit

Info found on: 

https://live.paloaltonetworks.com/t5/general-topics/log-forwarding-profile-in-all-security-policies/td-p/205426

FTD syslog event list

 https://www.cisco.com/c/en/us/td/docs/security/asa/syslog/b_syslog/syslogs1.html?bookSearch=true

anyconnect syslog ids for logon logoff

When user logs on: syslog# 716001

http://www.cisco.com/en/US/docs/security/asa/asa82/system/message/logmsgs.html#wp4776913

When user logs off: syslog# 716002

enable auditing/logging on NPS/radius server

View NPS events here:
Event viewer -> Custom Views\Server Roles\Network Policy and Access Services

Run CMD as administrator

Check if its on
auditpol /get /subcategory:"Network Policy Server"
If it shows "no auditing" its off

Switch it on (run CMD as admin)
auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable

Check if its on after running command above - had an issue where it didn't switch on, not sure what the problem was I was stopping/starting the NPS server around the same not.

Common issues

Confirm the IP's of radius clients are correct double check for any typos check name and the actual IP set

Confirm the shared secret matches on the client (WIFI AP etc) and server end (NPS server) often copying from a previous one will work fine.

Stop/Start NPS server after adding new radius clients

Check the NPS logs as detailed above while trying the radius connection

Run wireshark on NPS server to confirm radius request arrives

Saw an issue with a new zone directory the traffic.

Old ZD was working fine with radius

Moved to new ZD and its not working

We found the connection profile was not matching 

Old one was matching on "Wireless - IEEE 802.11"

The new traffic was showing up as "VPN" for some reason

Added VPN to the connection policies and it was working so moved on.

Check the nas id on wireshark packets coming in

check the event log/auditing

check if we can config the nas id on the ZD

Serer 2019 and windows firewall

sc sidtype IAS unrestricted

https://learn.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-firewalls-configure#windows-firewall-on-the-local-nps

Basically, by default the firewall on windows server 2019 block all the connections to NPS and this command changes it.

checkpoint tracker (live logs) not working

The CPs can stop logging due to server disk space filling up

Fix for this is – ssh to server and delete the old files

Navigate to $FWDIR/log and delete the old files

setting up syslog on cisco router

Send commands typed to syslog
archive
 log config
  logging enable
  notify syslog contenttype plaintext
  hidekeys

Send debugging logs to syslog
Send our origin id as our ip
Set facility to local0
Set source interfaces to gig0/0
Set logging host IP address of the syslog server
Switch logging on for all destinations
logging trap debugging
logging origin-id ip
logging facility local0
logging source-interface GigabitEthernet0/0
logging host x.x.x.x
logging on

Make sure your have routes to your syslog server
Also firewall rules, you need syslog (udp 514 open)