Skip to content

Create a new Palo Alto Networks Panorama machine

Creating a new machine is the initial step in enabling Certificate Manager - SaaS to connect directly to application keystores for certificate management. Once you have created machines, you can move on to provisioning certificates to those machines.

The Panorama connector supports certificate lifecycle management for the following use cases:

  • GlobalProtect — Discover and provision certificates used by GlobalProtect portal and gateway SSL/TLS Service Profiles.
  • Management Interface — Provision certificates to the Panorama management interface and push management certificates to managed NGFW devices via templates and device groups.
  • SSL Inbound Inspection — Discover and provision certificates used by SSL Inbound Inspection Decryption Policy Rules in your device groups.

Supported certificate locations

Certificate Manager - SaaS discovers and provisions certificates in every location where Panorama stores them. The location is set by the Template and Location fields of an installation:

Template Location Where the certificate is stored
Empty Not used Panorama's own configuration
A template Empty (Shared), or a virtual system (vsys) of the template, for example vsys1 The template's Shared location, or the named vsys
A template stack Not used (always Shared) The template stack's Shared location

The location is part of the installation's identity: a certificate with the same name in the Shared location and in vsys2 of the same template is tracked as two separate installations. Vsys names are case-sensitive, as they are in PAN-OS (VSYS1 is not vsys1).

How Certificate Manager - SaaS changes the Panorama configuration

Certificate Manager - SaaS commits and pushes only the changes made by the Panorama administrator it connects as. Changes that other administrators have made, or committed but not pushed, in the same template, template stack, or device group are left alone. For details, see Commit and push.

Use a dedicated Panorama administrator

Because commits and pushes are limited by administrator, create a Panorama administrator that only Certificate Manager - SaaS uses. If people sign in to Panorama with the same account, their pending changes in the affected templates and device groups are committed and pushed together with the certificate.

Before you begin

  • IP address or hostname of the Panorama machine
  • Minimum required credentials on the Panorama machine: Choose between user credentials or shared credentials.
    • User credentials: The username and password you enter.
    • Shared credentials: Optionally, you can use shared credentials from your credential provider (CyberArk is the only credential provider currently supported by Certificate Manager - SaaS). To use this option, first set up the connection to CyberArk.
  • A Panorama administrator with the minimum required permissions to access the XML API, preferably used by Certificate Manager - SaaS only. The administrator must be assigned to an Admin Role Profile with:
  • Role type: Panorama
  • XML API privileges:
    • Configuration
    • Operational Requests
    • Commit
    • Import
    • Export

  1. Enter the Server Hostname.

  2. From the Credential Type drop-down, select either Enter Credentials or Select Credentials. Only users with the enabled "CyberArk shared credential" capability will see this option.

    Important

    Your view of credentials may be limited due to your role. System Administrators and PKI Administrators should be able to select any credential, but users with the Resource Owner role are limited to only using the credentials associated with their teams.

    • Enter Credentials - Enter your Panorama administrator credentials in the Username and Password fields.
    • Select Credentials - Select your shared credentials from CyberArk in the Credential drop-down.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  3. Click Test Access, then click Continue. Note that Continue is only enabled if the Test Access is successful.

What's next?

Refer back to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling.

For existing machines: