topic How to deploy CA Palo Alto for non-join Domain! in General Topics

How to deploy CA Palo Alto for non-join Domain!

MOsama — Tue, 29 Aug 2017 11:54:08 GMT

Dear All,

we have done to install PALO ALTO 3020 on our network, but I have a problem as follows.

Now I have minimum 150 PCs not join the domain, and we need to deploy the CA for all of them by the automatid way!!!

everyone from this PCs has a User Name on Active Directory

Thanks

Re: How to deploy CA Palo Alto for non-join Domain!

drewdown — Tue, 29 Aug 2017 13:53:17 GMT

You have anything to manage those machines? Kace? Otherwise I guess you have to users install the cert on their own or write a script to do it for them? Same problem here but haven't deployed SSL decryption yet.

Re: How to deploy CA Palo Alto for non-join Domain!

Remo — Tue, 29 Aug 2017 16:27:15 GMT

@MOsama

Are these non domain joined computers only windows and are you also using global protect on the non-domain joined devices?

Re: How to deploy CA Palo Alto for non-join Domain!

MOsama — Wed, 30 Aug 2017 13:23:38 GMT

I don't have anything to manage those machines, just I have Active Directory maybe if you have any solution write it here, please

Re: How to deploy CA Palo Alto for non-join Domain!

MOsama — Wed, 30 Aug 2017 14:41:47 GMT

@Remo

Still, we not working on global protect. and this non-join-domain Is an employee bringing his own computer or his laptop windows based.

Re: How to deploy CA Palo Alto for non-join Domain!

Remo — Wed, 30 Aug 2017 19:02:19 GMT

With global protect(PAN-OS 8.0.x and GP 4.0.x) you'd have the ability to install a root CA in the clients trust store ... also on non domain joined computers.

But in your case, the only way is that your users install the cert on their own

Re: How to deploy CA Palo Alto for non-join Domain!

MOsama — Fri, 01 Sep 2017 22:08:14 GMT

@Remo

My understanding that I need to deploy the CA for all the user's device by device!

no way to deploy the CA by an automated way.

If I correct please tell me 🙂

Re: How to deploy CA Palo Alto for non-join Domain!

Raido_Rattameister — Sat, 02 Sep 2017 03:00:41 GMT

Yes to be able to decrypt SSL you need to install your own CA cert into all devices.