How to deploy CA Palo Alto for non-join Domain!

[MOsama]

Dear All,

we have done to install PALO ALTO 3020 on our network, but I have a problem as follows.

Now I have minimum 150 PCs not join the domain, and we need to deploy the CA for all of them by the automatid way!!! 

everyone from this PCs has a User Name on Active Directory 

Thanks

[drewdown]

You have anything to manage those machines? Kace? Otherwise I guess you have to users install the cert on their own or write a script to do it for them?   Same problem here but haven't deployed SSL decryption yet.  

[Remo]

@MOsama

Are these non domain joined computers only windows and are you also using global protect on the non-domain joined devices?

[MOsama]

I don't have anything to manage those machines, just I have Active Directory maybe if you have any solution write it here, please

[MOsama]

@Remo

Still, we not working on global protect. and this non-join-domain Is an employee bringing his own computer or his laptop windows based.

[Remo]

With global protect(PAN-OS 8.0.x and GP 4.0.x) you'd have the ability to install a root CA in the clients trust store ... also on non domain joined computers.

But in your case, the only way is that your users install the cert on their own

[MOsama]

@Remo

My understanding that I need to deploy the CA for all the user's device by device! 

no way to deploy the CA by an automated way.

If I correct please tell me 🙂

[Raido_Rattameister]

Yes to be able to decrypt SSL you need to install your own CA cert into all devices.