Syslog forwarding fails on multi-interface Log Collector

• Syslog forwarding not happening as configured
• Packet capture shows the TCP session between LC-SIEM is established

• PAN-OS 10.1
• Log Collector
• Multi-interface configuration

Review the IP Addressing plan so each interface has an IP in their own subnet.

Local Log Collector

1. Go to Panorama > Setup > Interfaces
2. Click on the interface to edit the interface's IP address
   
3. Update the IP address of the interface
   Note: 10.194.40.85/23 and 10.194.40.84/23 were in the same subnet. To resolve the issue the IP address of the interface is changed to be in another subnet.
   
4. Click OK
5. Commit the configuration change

Dedicated Log Collector

1. Go to Panorama > Managed Collector
2. Click on the Log Collector
   
3. Click on the Interfaces tab.
4. Click on the interface to edit the interface's IP address.

5. Update the IP address of the interface
   Note: 10.194.41.110/23 and 10.194.41.111/23 were in the same subnet. To resolve the issue the IP address of the interface is changed to be in another subnet.
   
6. Click OK
7. Commit the configuration change
8. Push to the Collector

Note: The syslog server must be reachable using the new IP address configured.