topic Re: Certificate to secure 100 plus SD WAN PANFW management interface for webui in Next-Generation Firewall Discussions

Certificate to secure 100 plus SD WAN PANFW management interface for webui

Daniel_Li — Fri, 26 Jan 2024 16:34:14 GMT

All

I plan to secure web interface for management of PANFW. we use data plane IP to manage all FWs. Is there way to deploy certs to each PAN via Panorama or it has to be done one by one. If any one did this before Please help and share

Thank you

Daniel

Re: Certificate to secure 100 plus SD WAN PANFW management interface for webui

iarobertson — Mon, 05 Feb 2024 00:13:31 GMT

Hello @Daniel_Li - do you have an enterprise CA that you can leverage? If so, and if you're fine with all of the firewalls having the same certificate on them, you could use a SAN certificate, or a wildcard certificate. The instructions here may help you.

If you need each device to have its own certificate, you may have some luck in automating the process via the CLI, but I'm not aware of any existing supported scripts to do this.

Re: Certificate to secure 100 plus SD WAN PANFW management interface for webui

Daniel_Li — Thu, 08 Feb 2024 16:20:45 GMT

Thank you Iain for your kind reply. We have Microsoft CA. Will try the link. Other question you could help answer. we are using loopback interface for webui access and managed by Panorama (not using management plane interface). How to implement SSL profile to loopback interface to secure it

Thank you

Re: Certificate to secure 100 plus SD WAN PANFW management interface for webui

iarobertson — Fri, 09 Feb 2024 00:44:37 GMT

Hello @Daniel_Li - please refer to this knowledgebase article; once SSL is set up, it is valid for all WebUI sessions.

Re: Certificate to secure 100 plus SD WAN PANFW management interface for webui

Daniel_Li — Fri, 09 Feb 2024 01:33:59 GMT

Thank you Iain. SSL profile works not only for management interface but other webui sessions. I will test.

Daniel

Re: Certificate to secure 100 plus SD WAN PANFW management interface for webui

Daniel_Li — Tue, 13 Feb 2024 20:26:00 GMT

Iain

I was told by Tech that SSL profile can not be applied to loopback interface in the data plane. Only to management interface in the management

plane. I have not tested but it seems to be correct technically

Daniel