Configure Palo Alto

This document provides information on how to configure the Palo Alto publishing profile to make it possible to install and publish certificates.

If the Palo Alto device is not directly reachable from Segura® Platform, the profile publishes through the Network Connector configured on the device.

Requirements

• A certificate generated and signed by a CA. More information in How to create a request and How to sign a request.
• A credential registered in Segura® with access to the Palo Alto device. More information in How to configure a credential in Segura®.
• A device registered in Segura® for the Palo Alto firewall. More information in How to configure a device.
  If the device is not directly reachable from Segura® Platform, configure a Network Connector on the device before creating the profile. The Network Connector configured on the device always takes precedence over a global Network Connector configured for the environment.
• An HTTPS connectivity on the device. The default port is 443. Without it, the publication fails with the error Equipment without HTTPS connectivity.

How the publication works

Segura® publishes the certificate through the PAN-OS XML API over HTTPS:

1. Generates an API key with the credential.
2. Imports the certificate and its private key as a PKCS12 keypair.
3. Sets the certificate on the SSL/TLS profile entered in the SSL/TLS profile field.
4. Commits the configuration on the firewall automatically.

The certificate name on the firewall is derived from the certificate's common name (CN): * is replaced by wildcard, invalid characters are replaced by _, and the name is truncated to 31 characters.

Configure Palo Alto

To configure Palo Alto, see the following steps:

1. On Segura®, in the navigation bar, hover over the Products menu and select Certificate Manager.
2. In the side menu, select Publishing > Publishing profiles.
3. In the actions button, select Palo Alto.
4. In the Settings tab, enter the following information:
   1. In the Profile name *, enter the profile's name.
   2. In the Credential username, enter the credential's name.
   3. Optional: Check the Use a registered credential to access all devices option and, in the Access credential registered in the system, select the access credential registered in Segura® to be used.
5. Click Continue.
6. In the Palo Alto tab, enter the following fields:
   1. In the SSL/TLS profile field, enter the SSL/TLS profile's name. A new name creates a profile; an existing name changes that profile's settings. If you leave this field empty, Segura® imports the certificate but cannot link it to an SSL/TLS profile, and you must link it manually on the firewall.
   2. Optional: In the Min version dropdown menu, select the oldest TLS protocol version the device accepts: TLSv1.0, TLSv1.1, or TLSv1.2.
   3. Optional: In the Max version dropdown menu, select the latest TLS protocol version the device accepts: TLSv1.0, TLSv1.1, TLSv1.2, or Max. The maximum version must be equal to or later than the minimum version. TLS 1.3 is not available.
7. Click Continue.
8. In the Devices tab, select the Palo Alto device.
   1. The device must be previously registered in Segura®.
   2. The Network Connector column shows Yes or No, depending on whether the device has its own Network Connector agent configured.
9. In the Review tab, review all information entered previously, and click Save.

Verify your results

The Palo Alto plugin does not run a post-publication verification step. Check the certificate directly on the Palo Alto device to confirm the publication succeeded.

If the device's Network Connector is unreachable or misconfigured, the plugin does not raise a dedicated error message. The operation fails with a generic exception instead. The only Network-Connector-specific trace is a log line (Network Connector: <agent>), recorded when the connection was routed through it.

More information in How to publish a certificate.