Skip to content

Create a new Palo Alto Networks Prisma Access machine

Creating a machine for Palo Alto Networks Prisma Access lets Certificate Manager - SaaS discover and provision the certificates in a Prisma Access tenant through the Strata Cloud Manager configuration API. Certificate Manager - SaaS manages the certificates that GlobalProtect uses through TLS service profiles, and the certificates that Remote Network and Service Connection IPsec tunnels use through IKE gateways. Each machine covers one Prisma Access tenant. After you create the machine, you can provision certificates to it.

Explicit Proxy isn't supported

Certificate Manager - SaaS doesn't discover or provision Explicit Proxy certificates.

Before you begin

  • You've started the machine in Create a new machine by selecting the machine type and entering its name, owning team, and VSatellite. The steps on this page continue from there.
  • A Strata Cloud Manager service account for the Prisma Access tenant, and its client ID and client secret.
  • The tenant's Tenant Service Group ID (TSG ID).
  • A role for the service account on that tenant that can read and write certificates, TLS service profiles, and IKE gateways, and can push configuration.
  • At least one active VSatellite connection that can reach the Strata Cloud Manager API and the Palo Alto Networks token endpoint over HTTPS (port 443). By default, these are api.strata.paloaltonetworks.com and auth.apps.paloaltonetworks.com.

  1. Enter the Client ID of the Strata Cloud Manager service account.

  2. Enter the Client Secret of the service account.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  3. Enter the Tenant Service Group ID of the Prisma Access tenant. Certificate Manager - SaaS requests every access token for this tenant only.

  4. (Optional) In API Base URL, enter the origin of the Strata Cloud Manager API, without a path. The default is https://api.strata.paloaltonetworks.com. The URL must use HTTPS and a paloaltonetworks.com host.

  5. (Optional) In Token Endpoint, enter the OAuth 2.0 token URL where Certificate Manager - SaaS exchanges the service account credentials for an access token. The default is https://auth.apps.paloaltonetworks.com/auth/v1/oauth2/access_token. The URL must use HTTPS and a paloaltonetworks.com host.

  6. Leave Verify TLS Certificates turned on. It's on by default.

    Warning

    Turn off Verify TLS Certificates only if a TLS-inspecting proxy sits between the VSatellite and Palo Alto Networks, and Certificate Manager - SaaS doesn't trust the proxy's certificate authority. With verification off, the client secret and every private key that Certificate Manager - SaaS uploads can be intercepted.

  7. Click Test Access, then click Continue. Continue is enabled only after the test succeeds.

    Note

    The test checks that Certificate Manager - SaaS can get an access token for the tenant and read its folder list. It doesn't check that the service account can write certificates or push configuration, so a missing permission shows up when you first provision a certificate.

What's next?

Refer back to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling. When you configure discovery, you can set these options:

  • Folder limits discovery to one Strata Cloud Manager folder, the folders below it, and their snippets, plus the certificates the folder inherits from the folders above it, such as Shared. Leave it empty to discover every folder in the tenant.

    Tip

    A folder discovery doesn't see the objects in sibling folders, so it reports a certificate that only a sibling folder uses as Not Bound. To see every binding, leave Folder empty.

  • Exclude Expired Certificates skips certificates whose validity period has ended. It's off by default.

  • Exclude CA Certificates skips certificate authority certificates, such as trusted roots and intermediates. It's on by default.

Discovery creates one installation for each TLS service profile or IKE gateway that uses a certificate. It reports a certificate that nothing uses once, with the Not Bound object type. IKE gateways that authenticate with a pre-shared key don't hold a certificate, so discovery skips them.

For existing machines: