>
    Strata Copilot
    Set Up Connectivity with an HSM
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. Certificate Management
    4. Secure Keys with a Hardware Security Module
    5. Set Up Connectivity with an HSM
    Download PDF
    Next-Generation Firewall

    Set Up Connectivity with an HSM

    Table of Contents

    Set Up Connectivity with an HSM

    Connect your NGFW or Panorama to a supported hardware security module (HSM) and review supported HSM client versions by PAN-OS release.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by PAN-OS or Panorama)
    • HSM set up and ready for deployment per vendor documentation
    • Static IP address assigned to NGFW management interface unless connecting through service route.
      The HSM authenticates firewalls by IP address. If the address changes at runtime, HSM operations fail.
    Before your Next-Generation Firewall (NGFW) or Panorama can offload cryptographic operations and protect its keys using a hardware security module (HSM), it must establish a secure connection to the HSM server. While the specific steps to establish trust vary by HSM product, the high-level process is the same:
    • Define connection settings for the HSM server
    • Authenticate the NGFW to the HSM
    • Register the NGFW as an HSM client
    • Verify connectivity
    PAN-OS does not sync HSM configurations between high availability (HA) firewall peers. You must configure the HSM separately on each peer. In active/passive HA configurations, you must manually perform one failover to configure and authenticate each HA peer to the HSM. After this initial failover, subsequent failovers don't require user interaction.
    PAN-OS integrates HSM client software with PA-3200 Series, PA-3400 Series, PA-5200 Series, PA-5400 Series, PA-7000 Series, PA-7500 and VM-Series firewalls and the Panorama management server (virtual and M-Series appliances).
    The following table lists supported HSM client versions by PAN-OS release.
    HSM ProductsHSM Client VersionsPAN-OS Versions
    Entrust nShield13.6.312.1.2 and later
    12.40.2 (backward compatible up to client version 11.50 for older appliances)10.2, 11.1, 11.2
    Thales Luna Network10.9.212.1.8
    5.4.2 and 7.2.010.2, 11.1, 11.2 through 12.1.7
    Thales CipherTrust Manager8.14.111.1 and later
    HSM client and server software must be compatible. Compatibility mismatches can result in connection failures. Refer to vendor documentation for a client-server compatibility matrix.
    Downgrading HSM servers might not be possible after you upgrade them.

    Set Up Connectivity with a Thales Luna Network HSM

    Connect your NGFW to a Thales Luna Network HSM server to enable secure private key storage outside the firewall.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by PAN-OS or Panorama)
    • Luna Network HSM ready for deployment
    • Luna HSM Client version compatible with HSM firmware and appliance version
    1. Log in to the firewall web interface.
    2. Define connection settings for the Thales Luna Network HSM.
      1. Select DeviceSetupHSM, and Edit the Hardware Security Module Details settings.
      2. For Provider Configured, select Thales Luna Network HSM.
      3. Add each HSM server.
        A high-availability HSM configuration requires at least two servers; you can cluster up to 16 HSM servers. All servers in the cluster must run the same Luna HSM version and authenticate separately. Use a Luna Network cluster only when you want to replicate the keys across the cluster.
        Alternatively, you can add up to 16 Luna Network HSM servers that function independently.
        If you configure two or more HSM servers, enable High Availability; otherwise, the firewall does not use the additional HSM servers.
        1. Enter a Module Name (up to 31 ASCII characters).
        2. Enter the IPv4 Server Address.
      4. (HA only) Enable High Availability, and then configure the following settings:
        • Auto Recovery Retry—Enter the maximum number of times the HSM client tries to recover its connection to an HSM server before failing over to a peer server (range is 0-500; default is 0)
        • High Availability Group Name—Enter a name for the HA group (up to 31 ASCII characters)
      5. Click OK and Commit your changes.
    3. (PAN-OS 12.1.7 and earlier) Select an HSM Client Version:
      • 5.4.2
      • 7.2.0
    4. Click OK and Commit your changes.
    5. (Optional) Configure a service route to connect to the HSM if you don’t want the firewall to connect through the management interface (default).
      If you configure a service route for the HSM, running the clear session all CLI command clears all existing HSM sessions, which brings all HSM states down and then up again. During the several seconds required for recovery, all SSL/TLS operations fail.
      1. Select DeviceSetupServices and click Service Route Configuration.
      2. Customize a service route. The IPv4 tab is active by default.
      3. Click HSM in the Service column.
      4. Select a Source Interface for the HSM.
      5. Click OK and Commit your changes.
    6. Configure the firewall to authenticate to the HSM.
      1. Select DeviceSetup and Setup Hardware Security Module.
      2. Select the HSM Server Name.
      3. Select Automatic or Manual for your authentication and trust certificate.
      4. Enter the Administrator Password to authenticate the firewall to the HSM.
      5. Click OK.
        The firewall tries to authenticate to the HSM and displays a status message.
      6. Click OK again.
    7. Register the firewall as an HSM client and assign it to a partition on the HSM server.
      If a client (firewall) with the same <cl-name> is already registered on the HSM, you must delete the duplicate registration before registering the new client. Run the client delete -client <cl-name> command, where <cl-name> is the name of the registered client you want to delete.
      1. Log in to the HSM from a remote system.
      2. Register the firewall using the client register -c <cl-name> -ip <fw-ip-addr> CLI command, where <cl-name> is the name you assign to the firewall for use on the HSM and <fw-ip-addr> is the IP address for that firewall.
      3. Assign a partition to the firewall using the client assignpartition -c <cl-name> -p <partition-name> CLI command, where <cl-name> is the name you assigned to the firewall using the client register command and <partition-name> is the name of a previously configured partition that you want to assign to this firewall.
    8. Configure the firewall to connect to the HSM partition.
      1. Select DeviceSetupHSM and refresh (
        ) the display.
      2. Setup HSM Partition (Hardware security operations settings).
      3. Enter the Partition Password to authenticate the firewall to the partition on the HSM.
      4. Click OK.
    9. (HA only) Repeat the previous authentication, registration, and partition connection steps to add another HSM to the existing HA group.
      If you remove an HSM from your configuration, repeat the previous partition connection step to remove the deleted HSM from the HA group.
    10. Verify firewall connectivity and authentication with the HSM.
      1. Select DeviceSetupHSM and check the authentication and connection Status:
        • Green—The firewall successfully authenticated and connected to the HSM.
        • Red—The firewall failed to authenticate or connect to the HSM.
      2. View the following columns in Hardware Security Module Status to determine the authentication status:
        • Serial Number—The serial number of the HSM partition if the firewall successfully authenticated to the HSM.
        • Partition—The partition name on the HSM assigned to the firewall.
        • Module State—The current state of the HSM connection. This value is always Authenticated if the Hardware Security Module Status displays the HSM.

    Set Up Connectivity with an Entrust nShield HSM

    Establish a secure connection between your NGFW and an Entrust nShield hardware security module (HSM).
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by PAN-OS or Panorama)
    • Entrust nShield HSM installed and enrolled in a Security World
    • Remote file system (RFS) configured on a host running nShield Security World software (Windows or Linux)
    ECDSA certificates are not supported for Entrust nShield HSMs.
    1. Define connection settings for each nShield HSM.
      1. Log in to the firewall web interface and select DeviceSetupHSM.
      2. Edit the hardware security module provider settings and set the Provider Configured to Entrust nShield HSM.
      3. Add each HSM server as follows. An HA HSM configuration requires two servers:
        1. Enter a Module Name for the HSM server. This can be any ASCII string of up to 31 characters.
        2. Enter an IPv4 address for the HSM Server Address.
      4. Enter an IPv4 address for the Remote Filesystem Address.
      5. Click OK and Commit your changes.
    2. (Optional) Configure a service route to connect to the HSM if you don’t want the firewall to connect through the management interface (default).
      If you configure a service route for the HSM, running the clear session all CLI command clears all existing HSM sessions, which brings all HSM states down and then up again. During the several seconds required for HSM to recover, all SSL/TLS operations will fail.
      1. Select DeviceSetupServices and click Service Route Configuration.
      2. Customize a service route. The IPv4 tab is active by default.
      3. Click HSM in the Service column.
      4. Select a Source Interface for the HSM.
      5. Click OK and Commit your changes.
    3. Register the firewall as an HSM client with the HSM server.
      This step describes the procedure for using the front panel interface of an nShield HSM. For more details, refer to nShield documentation.
      1. Log in to the front panel display of the nShield HSM.
      2. Use the right-hand navigation button to select SystemSystem configurationClient configNew client.
      3. Enter the firewall IP address.
      4. Select SystemSystem configurationClient configRemote file system and enter the IP address of the client computer where you set up the RFS.
    4. Configure the RFS to accept connections from the firewall.
      1. Log in to the RFS from a Linux client.
      2. Obtain the electronic serial number (ESN) and the hash of the KNETI key, which authenticates the HSM to clients, by running the anonkneti <ip-address> CLI command, where <ip-address> is the HSM IP address.
        For example:
        anonkneti 192.0.2.1
        B1E2-2D4C-E6A2 5a2e5107e70d525615a903f6391ad72b1c03352c
        In this example, B1E2-2D4C-E6A2 is the ESN and 5a2e5107e70d525615a903f6391ad72b1c03352c is the hash of the KNETI key.
      3. Use the following command from a superuser account to set up the RFS:
        rfs-setup --force <ip-address> <ESN> <hash-Kneti-key>
        The <ip-address> is the IP address of the HSM, <ESN> is the electronic serial number, and <hash-Kneti-key> is the hash of the KNETI key.
        The following example uses the values obtained in this procedure:
        rfs-setup --force 192.0.2.1 B1E2-2D4C-E6A2 5a2e5107e70d525615a903f6391ad72b1c03352c
      4. Use the following command to permit HSM client submissions on the RFS:
        rfs-setup --gang-client --write-noauth <FW-IPaddress>
        where <FW-IPaddress> is the firewall IP address.
    5. Authenticate the firewall to the HSM.
      1. In the firewall web interface, select DeviceSetupHSM and Setup Hardware Security Module.
      2. Click OK.
        The firewall tries to authenticate to the HSM and displays a status message.
      3. Click OK.
    6. Synchronize the firewall with the RFS by selecting DeviceSetupHSM and Synchronize with Remote Filesystem.
    7. Verify firewall connectivity and authentication with the HSM.
      1. Select DeviceSetupHSM and check the authentication and connection Status:
        • Green—The firewall is successfully authenticated and connected to the HSM.
        • Red—The firewall failed to authenticate to the HSM or network connectivity to the HSM is down.
      2. Check the Hardware Security Module Status to determine the authentication status.
        • Name—The name of the HSM.
        • IP address—The IP address of the HSM.
        • Module State—The current state of the HSM connection: Authenticated or NotAuthenticated.

    Set Up Connectivity with a Thales CipherTrust Manager HSM

    Set up HSM connectivity to use Thales CipherTrust Manager.
    1. Define connection settings for each Thales CipherTrust Manager HSM.
      1. Log in to the firewall web interface and select DeviceSetupHSM.
      2. Edit the hardware security module provider settings and set the Provider Configured to Thales CipherTrust Manager.
      3. Add each HSM server as follows. An HA HSM configuration requires two servers.
        1. Enter a Module Name for the HSM server. This can be any ASCII string of up to 31 characters.
        2. Enter an IPv4 address for the HSM Server Address.
      4. Click OK and Commit your changes.
    2. Set Up HSM Connectivity Account.
      1. Enter the Server Name. This should match the Module Name from the connection setting.
      2. Import the certificates you generated in Thales CipherTrust Manager.
        • HSM Server CA Certificate—Import a Base64 encoded certificate (PEM).
        • HSM Client Certificate—Import a Base64 encoded certificate (PEM).
        • HSM Client Private Key—Import a Base64 encoded certificate (PEM) and enter a Passphrase fewer than 32 characters.
      3. Click OK.
    3. Restart HSM Connection to refresh the PAN-OS state. This removes the old certificates and adds the new certificates.
      1. Click OK.
      2. Wait for the module state to display as Reachable.
    4. Set Up HSM Crypto User Account to match the Thales CipherTrust Manager account you want to use.
      1. Enter a Username.
      2. Enter a Password.
      3. Click OK.
      The success dialog displays and the Status changes to green in the dashboard.
    5. Show Detailed Information to view the new fields.
    6. Confirm that your certificate is imported and valid.
      1. Select DeviceCertification ManagementCertificates, then Device Certificates (PAN-OS 11.2 and earlier) or Custom Certificates (PAN-OS 12.1.0 and later).
      2. Confirm that the Key displays a lock and the Status is valid.

    © 2026 Palo Alto Networks, Inc. All rights reserved.