PAN-OS

1Set up PAN-OS Virtual Appliance

2Configure Luna HSM

1Access the PAN-OS Web console via the IP address configured during deployment. For example: https:/PAN-OS-Web_Interface_IP.

2Apply the PAN-OS license.

Note

The HSM feature requires a valid license. Refer to Palo Alto Product Documentation for further details on licenses and subscriptions.

3Configure PAN-OS to use a static IP address.

Note

Before connecting with Luna HSM, PAN-OS must be authenticated using its IP address. It's crucial to configure PAN-OS with a static IP address instead of relying on a dynamic IP address assigned via DHCP. Changes to the PAN-OS IP address during runtime may disrupt HSM operations.

1Establish connectivity with a Luna HSM

2Encrypt the master key

3Rotate the master key used for encryption

4Safely store private keys on the Luna HSM

1Add Luna HSM server information to PAN-OS

2Configure PAN-OS for authentication with the HSM

3Register PAN-OS as an HSM client and allocate a partition

4Configure PAN-OS to link to the designated HSM partition

5Configure PAN-OS to connect to the HA slot

6Verify connectivity and authentication between PAN-OS and the HSM

1Access the PAN-OS web interface at https://PAN-OS-Web_Interface_IP. Log in and navigate to Device > Setup > HSM.

2In the Hardware Security Module Details section, select SafeNet Network HSM from the Provider Configured drop-down menu.

3Click Add to enter Luna HSM server details:

• Enter a Module Name (up to 31 ASCII characters) for the Luna HSM server.

• Enter the Luna HSM IPv4 address in the Server Address.

4If configuring high availability (HA), repeat step 3 for each Luna HSM server, specifying:

• High Availability

• Auto Recovery Retry value (0 to 500; default is 0)

• High Availability Group Name (up to 31 ASCII characters)

Note

For HA configurations, at least two Luna HSM servers are required. Up to 16 servers can be clustered, and all servers must run the same Luna HSM version. HA is recommended for key replication.

Note

Enabling HA is considered best practice when configuring multiple HSM servers. This ensures redundancy and enhances the reliability of the system in case of hardware or network failures.

5Click OK and then Commit to save the changes.

6Select the HSM Client Version:

• Use HSM Client v7.2.0 for PAN-OS 10.x and later.

• Use HSM Client v6.3.0 for PAN-OS 9.x.

7Click OK and then Commit to save the changes.

8Optionally, configure a service route to connect to the HSM if you don't want to use the management interface:

• Navigate to Device > Setup > Services > Service Route Configuration.

• Select Customize a service route, ensuring the IPv4 tab is active by default.

• Select HSM in the Service column.

• Choose a Source Interface for the HSM, specifying the network interface used for communication.

• Confirm changes by clicking OK and committing them.

Warning

When configuring a service route, keep in mind that PAN-OS will communicate with the HSM through the specified interface, bypassing the default management interface. Be cautious, as this setup may lead to a temporary disruption in SSL/TLS operations. Additionally, exercise care when executing the clear session all command, as it will reset all existing HSM sessions, temporarily bringing down HSM states until recovery. During this recovery period, all SSL/TLS operations will fail for several seconds.

1Access the PAN-OS web interface and navigate to Device > Setup > HSM > Setup Hardware Security Module.

2Select the Server Name from the list of HSM modules you previously added.

3Choose the HSM Authentication method:

Automatic

This method allows PAN-OS to automatically authenticate with the Luna HSM using the HSM Administrator Password. To configure automatic authentication:

(a) Enter the HSM Administrator Password, which is the Luna HSM admin password.

(b) Click OK to proceed.

(c) PAN-OS will attempt to authenticate with the HSM and display a status message. Click OK to close the message window.

Manual

This method requires manual upload of the HSM server certificate to PAN-OS. To configure manual authentication:

(a) Copy the server.pem file from the Luna HSM using a remote file transfer protocol such as SCP from a Linux or Windows machine. For instance, you can execute the following command: scp admin@10.164.75.32:server.pem /home. Ensure to replace admin@10.164.75.32 with the appropriate username and IP address of your Luna HSM, and /home with the desired destination directory on your local machine. When prompted, enter the HSM Admin password to authenticate the file transfer.

(b) Select Import And Install HSM Server Certificate.

(c) Click Browse and select the server.pem file you copied in step a. Click OK to upload the certificate to PAN-OS.

(d) Click Close to complete the upload process.

(e) Click Export HSM Client Certificate to download the client certificate file.

(f) Copy the client certificate to a Linux or Windows machine for transfer to the HSM device. Use the command scp /home/10.164.76.45.pem admin@10.164.75.32: to transfer the file. Provide the HSM admin password when prompted.

1Access the Luna HSM interface using admin credentials.

2Register PAN-OS as a client:

client register -c <PAN-OS_client_name> -ip <PAN-OS_IP>

3Assign a partition to PAN-OS:

client assignpartition -c <PAN-OS_client_name> -p <partition-name>

Note

If an existing PAN-OS client with the same name is already registered on the HSM, you must remove the duplicate registration before registering the new client. Use the command client delete -client <PAN-OS_client_name> to remove the duplicate registration.

1Navigate to Device > Setup > HSM and refresh the display.

2Access the Setup HSM Partition within the Hardware Security Operations settings.

3Authenticate PAN-OS to the Luna HSM partition by entering the partition password, which corresponds to the crypto officer password. Click OK to proceed.

4Upon successful authentication, a confirmation of the status will be displayed. Click OK to acknowledge the successful connection.

1Repeat the previous steps to authenticate, register, and configure the partition for an additional Luna HSM server to be added to the existing HA group.

2If you need to remove a Luna HSM server from the configuration, repeat the partition connection step to remove the deleted server from the HA group.

3For PAN-OS 9.x, perform these additional steps:

(a) Log in to the PAN-OS CLI.

(b) Create the HA group:

request hsm ha create-ha-group password

(c) Synchronize the members of the HA group:

request hsm ha synchronize password

(d) Replace the HSM servers in the HA group:

request hsm ha replace-server password

1Navigate to Device > Setup > HSM and review the authentication and connection status:

• Green: Indicates successful authentication and connection to the HSM.

• Red: Indicates authentication failure or lack of network connectivity to the HSM.

2Check the following columns in the Hardware Security Module Status section to assess the authentication status:

• Serial Number: Displays the serial number of the HSM partition (available only if PAN-OS successfully authenticated).

• Partition: Shows the name of the partition assigned to PAN-OS.

• Module State: Indicates the current state of the HSM connection; always displays Authenticated if the Hardware Security Module Status shows the HSM.

1Log in to the PAN-OS web interface and navigate to Device > Master Key and Diagnostics.

2Access the Master Key settings:

• Specify the current key used for encrypting private keys and passwords on the PAN-OS in the Master Key field.

• If changing the master key, enter the new master key and confirm.

3Enable the Stored on HSM option and provide the following values:

• Life Time: Set the expiration period for the master key (1-730 days).

• Time for Reminder: Define when users should be notified before the key expires (1-365 days).

4Click OK to save the settings.

1Log in to the PAN-OS CLI.

2Execute the following CLI command to rotate the wrapping key for the master key on the HSM:

request hsm mkey-wrapping-key-rotation

Note

If the master key is already encrypted on the HSM, the CLI command will generate a new wrapping key on the HSM and re-encrypt the master key with the new wrapping key.

Note

If the master key is not currently encrypted on the HSM, the CLI command will create a new wrapping key on the HSM for future encryption. The old wrapping key will be retained and not deleted by this command.

1Create a key pair using the cmu utility:

./cmu gen -modulusBits=2048 -publicExp=65537 -sign=T -verify=T

Note

Provide the partition password when prompted.

2List the generated key using the cmu utility:

./cmu list

Note

Provide the partition password when prompted.

3Create a self-signed certificate:

./cmu selfSign -C=CA -O=thales -startDate=20190101 -endDate=20250101 -CN="test.thales.com"

4Verify that the certificate was generated successfully:

./cmu list

Note

Provide the partition password when prompted.

5Export the generated certificate:

./cmu export

Note

Provide the partition password and a filename when prompted.

6Copy the exported certificate file to your workstation from where you are accessing the PAN-OS web console.

1Navigate to Device > Certificate Management > Certificates > Device Certificates.

2Click the Import button.

3In the Certificate Type field, select Local.

4Enter a descriptive name for the certificate in the Certificate Name field.

5Browse to locate the certificate file that was exported from the Luna HSM partition.

6Select the appropriate file format for the certificate.

7Check the Private Key resides on Hardware Security Module option.

8Click OK to confirm the import, and then click Commit to save the changes.

9The imported certificate details will now be listed under Device Certificates.

1Open the imported certificate for editing within the PAN-OS web interface.

2Choose the option for Forward Trust Certificate.

3Click OK to confirm the selection, and then proceed to click Commit to save the changes effectively.

1Locate the certificate you imported within the PAN-OS web interface.

2Examine the icon displayed in the Key column:

• Lock icon: Indicates that the private key for the certificate is securely stored on the Luna HSM.

• Error icon: Signifies that the private key is not stored on the HSM, or the HSM is not properly authenticated or connected to PAN-OS.