Skip to main content

Palo Alto Networks

SecTrail CM enables automatic deployment and renewal of SSL certificates by establishing agentless connections to Palo Alto Networks firewall devices.

Connection Requirements​

RequirementDetailDescription
ProtocolXML API (HTTPS)Palo Alto's native XML API is used
Port443Standard HTTPS port or custom management port
AuthenticationUsername and PasswordAuthentication via Username and Password
User PermissionAdmin or Certificate Manager roleCertificate upload and configuration permission

Automated Operations​

SecTrail CM automatically performs the following operations on Palo Alto Networks firewall:

  1. Certificate and Key Upload: Secure transfer of SSL certificate and private key
  2. Certificate Import: Importing certificate and key to the device
  3. SSL Profile Update: Updating SSL decryption profiles
  4. Configuration Commit: Committing and making configuration persistent

Configuration Steps​

1. Creating Palo Alto User​

Navigate to Automation > Device Users and create a user for Palo Alto.

2. Adding Palo Alto Device to SecTrail CM​

Click Automation > Devices > Add New Device button and enter the following information:

Palo Alto Device Creation

  • Name: Provide a descriptive name for the device
  • Device Users: Select the user created in Step 1
  • IP: Enter the management IP address of the Palo Alto device
  • Device Type: Select Palo Alto Firewall from the dropdown menu
  • Deployment Type: Select deployment type
    • Append: Adds new certificate to existing decryption rule (existing certificates are preserved)
    • Override: Replaces existing certificate with new one (old certificate is deleted)
  • Cert Upload Only: Should only certificate be uploaded? (Disabled/Enabled)
  • Force Sync: Should changes be automatically committed? (Disabled/Enabled)
  • Wait For Completion: Should commit operation completion be awaited? (Disabled/Enabled)
Automatic Discovery and Monitoring

After the Palo Alto device is added to SecTrail CM, all certificates defined on the device are automatically included in the discovery period and scanned regularly. Automatic alarms are created for certificates that are about to expire or have issues.

3. Viewing Device Information​

After the device is added, it will be displayed in the Automation > Devices list. Click on the row to view device details:

Palo Alto Device Details and Virtual Server List

  • Name: Certificate names defined on the device
  • Destination: Certificate usage area (any, tunnel-ip, etc.)
  • Subject: Certificate subject information
  • Fingerprints: Certificate fingerprint
  • NotAfter: Certificate expiration date
  • Deploy: For certificate deployment

Certificate Deployment​

Step 1: Virtual Server and Certificate Selection​

  1. Select your Palo Alto device from Automation > Devices
  2. In the device details, find the Virtual Server where you want to deploy the certificate
  3. Click the Deploy button on the relevant row
  4. In the Deploy Certificate window that opens:
    • Virtual Servers: Target Virtual Server information is displayed (Name/Destination/Subject format)
    • Certificate: Select the certificate you want to deploy from the dropdown menu

Certificate Deployment Screen

Step 2: Starting the Deployment Process​

Click the Deploy button to start the certificate deployment process.

Step 3: Process Tracking​

The deployment process can be tracked from Automation > Processes:

Palo Alto Deployment Operations

Operation Details​

The following steps are performed during deployment:

StepOperation Description
1Certificate is successfully updated
2Decryption rules are configured
3Configuration is committed
4Configuration is successfully completed
Automatic Commit

SecTrail CM automatically commits configuration changes after deployment and makes them persistent.

Rollback Operation​

The Manual Rollback feature can be used in case of issues after certificate deployment.

Automatic Rollback

If an error occurs at any step during the deployment process, the system automatically performs a rollback and all changes are reverted.

Rollback Steps​

  1. Navigate to Automation > Processes
  2. Find the operation you want to rollback
  3. Use the Manual-Rollback option in the Status column
  4. Confirm

Operations During Rollback​

StepOperation
1Newly uploaded certificate is deleted
2Previous configuration is restored
3Decryption rules are reverted to their previous state
4Rollback operation is successfully completed