Palo Alto Networks connection

A Palo Alto Networks connection authenticates Infisical to a PAN-OS firewall or a Panorama with the username and password of a PAN-OS administrator, so Palo Alto Networks certificate syncs can import certificates and commit the changes.

This guide only authenticates Infisical with your Palo Alto Networks device. Once the app connection is ready, you can use it to set up integrations.

Prerequisites

A PAN-OS administrator account with the Superuser role on the firewall or Panorama, so you can create an Admin Role profile and another administrator
Network access from Infisical to the device’s management interface over HTTPS, either directly or through an Infisical Gateway

Step 1: Create a dedicated PAN-OS administrator

The connection signs in as a PAN-OS administrator that can use the XML API. Create a dedicated account for it, because each sync commits every pending change made with that account, including a person’s unfinished edits.

In the PAN-OS web interface, go to Device > Admin Roles and select Add. On a Panorama, go to Panorama > Admin Roles instead.

Enter a Name for the profile. On the XML API tab, enable only Configuration, Operational Requests, Commit, and Import.

On the Web UI and REST API tabs, disable every item, because the connection uses neither one. Then select OK.

Go to Device > Administrators (or Panorama > Administrators on a Panorama) and select Add.

Enter a Name and Password for the account. Set Administrator Type to Role Based and select the Admin Role profile you created as the Profile. Then select OK.

Commit the changes.

Step 2: Create the app connection

Next, create the app connection in Infisical.

To create the connection using the API, use the Create Palo Alto Networks Connection endpoint.

In Certificate Manager, go to Settings > App Connections and select Add Connection.

Select Palo Alto Networks.

Fill out the form’s fields:

Name: a name for the connection
Description (optional): a description of the connection
Gateway (optional): the Infisical Gateway to connect through, if the device is on a private network
Hostname: the IP address or hostname of the device’s management interface, such as firewall.example.com
Username: the username of the administrator from Step 1
Password: the password of that administrator
Port (optional): the HTTPS port of the management interface (defaults to 443)

On the SSL tab, set how the connection verifies the TLS certificate of the management interface. PAN-OS uses a self-signed certificate for the management interface by default, so do one of the following:

Paste the certificate of the CA that issued the management interface certificate, in PEM format, into SSL Certificate
Turn off Reject Unauthorized to skip verification

Select Connect to Palo Alto Networks.

Your Palo Alto Networks app connection is ready to use.

Step 3: Configure integrations

Now that your Palo Alto Networks app connection is configured, you can use it to set up the following integrations: