Install the Panorama Device Certificate
Table of Contents
Install the Panorama Device Certificate
Install the Panorama device certificate to leverage Palo Alto Networks cloud
services.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
|
You must install the device certificate on the Panorama™ management server to use one
or more cloud services. You only need to install a
device certificate once. The device certificate has a 90-day lifetime. The firewall
reinstalls the device certificate 15 days before the certificate expires. In the
event Panorama is unable to reinstall the device certificate on its own, you may
need to manually restore an expired device certificate.
To successfully install the device certificate, Panorama must have an outbound
internet connection and the following Fully Qualified Domain Names (FQDN) and ports
must be allowed on your network.
|
FQDN
|
Ports
|
|---|---|
|
TCP 80
|
|
TCP 443
|
|
TCP 444 and TCP 443
|
- Generate the One Time Password (OTP).OTP lifetime is 60 minutes and expires if not used within the 60 minute lifetime.Panorama may only attempt to retrieve the OTP from the CSP one time. If Panorama fails for any reason to fetch the OTP, the OTP expires and you must generate a new OTP.
- Log in to the Customer Support Portal with a user role that has permission to generate an OTP.
- Select and Generate OTP.
- For the Device Type, select Generate OTP for Panorama and click Next.
- Select the Panorama Device serial number and Generate OTP.
- Generate OTP and copy the OTP.
- Log in to the Panorama Web Interface as a Superuser.A Panorama admin with Superuser access privileges is required to required to apply the OTP used to install the device certificate on Panorama.
- Configure the Network Time Protocol (NTP) server.An NTP server is required to validate the device certification expiration date, ensure the device certificate does not expire early or become invalid.
- Select .
- Select NTP and enter the hostname or IP address of the Primary NTP Server.
- (Optional) Enter a the hostname or IP address of the Secondary NTP Server.
- (Optional) To authenticate time updates from the NTP
server(s), for Authentication Type, select one of
the following for each server.
-
None (default)—Disables NTP authentication.
-
Symmetric Key—Firewall uses symmetric key exchange (shared secrets) to authenticate time updates.
-
Key ID—Enter the Key ID (1-65534)
-
Algorithm—Select the algorithm to use in NTP authentication (MDS or SHA1)
-
-
- Click OK to save your configuration changes.
- Select Commit and Commit to Panorama.
- Log in to the Panorama Web Interface as an admin user.
- Select and Get
certificate.
![]()
- Enter the One-time Password you generated and click OK.
- Panorama successfully retrieves and install the certificate.
![]()
