paloalto-firewall-orchestrator

KO | EN

gitlite — search

#javascript #typescript #golang #go #machine-learning #rust #linux #docker #macos #java #kubernetes #mcp #openai #open-source

paloalto-firewall-orchestrator

(★ 10)

Orchestrator for PA-VM Firewall. This supports Add, Remove and Inventory Functions. Secure multiple public cloud environments with the same level of protection as on-premises data centers. Consistently protect against advanced threats with full traffic visibility and control.

paloalto-firewall-orchestrator Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

<h1 align="center" style="border-bottom: none">
 Palo Alto Universal Orchestrator Extension
</h1>

<img src="https://img.shields.io/badge/integration_status-production-3D1973?style=flat-square" alt="Integration Status: production" />
<a href="https://github.com/Keyfactor/paloalto-firewall-orchestrator/releases"><img src="https://img.shields.io/github/v/release/Keyfactor/paloalto-firewall-orchestrator?style=flat-square" alt="Release" /></a>
<img src="https://img.shields.io/github/issues/Keyfactor/paloalto-firewall-orchestrator?style=flat-square" alt="Issues" />
<img src="https://img.shields.io/github/downloads/Keyfactor/paloalto-firewall-orchestrator/total?style=flat-square&label=downloads&color=28B905" alt="GitHub Downloads (all assets, all releases)" />

<a href="#support">
 Support
 </a>
 ·
 <a href="#installation">
 Installation
 </a>
 ·
 <a href="#license">
 License
 </a>
 ·
 <a href="https://github.com/orgs/Keyfactor/repositories?q=orchestrator">
 Related Integrations
 </a>

## Overview

The Palo Alto Orchestrator Extension is an integration that can replace and inventory certificates on either a Panoroama instance or Firewall Instance, depending on the configuration.  The certificate store types that can be managed in the current version are:

* PaloAlto - See [Test Cases](#test-cases) For Specific Use Cases that are supported.

## Compatibility

This integration is compatible with Keyfactor Universal Orchestrator version 10.4 and later.

## Support
The Palo Alto Universal Orchestrator extension is supported by Keyfactor. If you require support for any issues or have feature request, please open a support ticket by either contacting your Keyfactor representative or via the Keyfactor Support Portal at https://support.keyfactor.com.

> If you want to contribute bug fixes or additional enhancements, use the **[Pull requests](../../pulls)** tab.

## Requirements & Prerequisites

Before installing the Palo Alto Universal Orchestrator extension, we recommend that you install [kfutil](https://github.com/Keyfactor/kfutil). Kfutil is a command-line tool that simplifies the process of creating store types, installing extensions, and instantiating certificate stores in Keyfactor Command.

## PaloAlto Certificate Store Type

To use the Palo Alto Universal Orchestrator extension, you **must** create the PaloAlto Certificate Store Type. This only needs to happen _once_ per Keyfactor Command instance.

#### Supported Operations

| Operation    | Is Supported                                                                                                           |
|--------------|------------------------------------------------------------------------------------------------------------------------|
| Add          | ✅ Checked        |
| Remove       | ✅ Checked     |
| Discovery    | 🔲 Unchecked  |
| Reenrollment | 🔲 Unchecked |
| Create       | 🔲 Unchecked     |

#### Store Type Creation

##### Using kfutil:
`kfutil` is a custom CLI for the Keyfactor Command API and can be used to create certificate store types.
For more information on [kfutil](https://github.com/Keyfactor/kfutil) check out the [docs](https://github.com/Keyfactor/kfutil?tab=readme-ov-file#quickstart)
 <details><summary>Click to expand PaloAlto kfutil details</summary>

##### Using online definition from GitHub:
   This will reach out to GitHub and pull the latest store-type definition
   ```shell
   # PaloAlto
   kfutil store-types create PaloAlto
   ```

##### Offline creation using integration-manifest file:
 If required, it is possible to create store types from the [integration-manifest.json](./integration-manifest.json) included in this repo.
 You would first download the [integration-manifest.json](./integration-manifest.json) and then run the following command
 in your offline environment.
 ```shell
 kfutil store-types create --from-file integration-manifest.json
 ```
 </details>

#### Manual Creation
Below are instructions on how to create the PaloAlto store type manually in
the Keyfactor Command Portal
 <details><summary>Click to expand manual PaloAlto details</summary>

Create a store type called `PaloAlto` with the attributes in the tables below:

##### Basic Tab
   | Attribute | Value | Description |
   | --------- | ----- | ----- |
   | Name | PaloAlto | Display name for the store type (may be customized) |
   | Short Name | PaloAlto | Short display name for the store type |
   | Capability | PaloAlto | Store type name orchestrator will register with. Check the box to allow entry of value |
   | Supports Add | ✅ Checked | Check the box. Indicates that the Store Type supports Management Add |
   | Supports Remove | ✅ Checked | Check the box. Indicates that the Store Type supports Management Remove |
   | Supports Discovery | 🔲 Unchecked |  Indicates that the Store Type supports Discovery |
   | Supports Reenrollment | 🔲 Unchecked |  Indicates that the Store Type supports Reenrollment |
   | Supports Create | 🔲 Unchecked |  Indicates that the Store Type supports store creation |
   | Needs Server | ✅ Checked | Determines if a target server name is required when creating store |
   | Blueprint Allowed | 🔲 Unchecked | Determines if store type may be included in an Orchestrator blueprint |
   | Uses PowerShell | 🔲 Unchecked | Determines if underlying implementation is PowerShell |
   | Requires Store Password | 🔲 Unchecked | Enables users to optionally specify a store password when defining a Certificate Store. |
   | Supports Entry Password | 🔲 Unchecked | Determines if an individual entry within a store can have a password. |

The Basic tab should look like this:

![PaloAlto Basic Tab](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-basic-store-type-dialog.png)

##### Advanced Tab
   | Attribute | Value | Description |
   | --------- | ----- | ----- |
   | Supports Custom Alias | Required | Determines if an individual entry within a store can have a custom Alias. |
   | Private Key Handling | Optional | This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid. |
   | PFX Password Style | Default | 'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.) |

The Advanced tab should look like this:

![PaloAlto Advanced Tab](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-advanced-store-type-dialog.png)

> For Keyfactor **Command versions 24.4 and later**, a Certificate Format dropdown is available with PFX and PEM options. Ensure that **PFX** is selected, as this determines the format of new and renewed certificates sent to the Orchestrator during a Management job. Currently, all Keyfactor-supported Orchestrator extensions support only PFX.

##### Custom Fields Tab
   Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:

| Name | Display Name | Description | Type | Default Value/Options | Required |
   | ---- | ------------ | ---- | --------------------- | -------- | ----------- |
   | ServerUsername | Server Username | Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration). | Secret |  | 🔲 Unchecked |
   | ServerPassword | Server Password | Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration). | Secret |  | 🔲 Unchecked |
   | ServerUseSsl | Use SSL | Should be true, http is not supported. | Bool | true | ✅ Checked |
   | DeviceGroup | Device Group | A semicolon delimited list of Device Groups that Panorama will push changes to (i.e. 'Group 1', 'Group 1;Group 2', or 'Group 1; Group 2', etc.). | String |  | 🔲 Unchecked |
   | InventoryTrustedCerts | Inventory Trusted Certs | If false, will not inventory default trusted certs, saves time. | Bool | false | ✅ Checked |
   | TemplateStack | Template Stack | Template stack used for device push of certificates via Template. | String |  | 🔲 Unchecked |

The Custom Fields tab should look like this:

![PaloAlto Custom Fields Tab](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-custom-fields-store-type-dialog.png)

###### Server Username
   Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration).

> [!IMPORTANT]
   > This field is created by the `Needs Server` on the Basic tab, do not create this field manually.

###### Server Password
   Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration).

> [!IMPORTANT]
   > This field is created by the `Needs Server` on the Basic tab, do not create this field manually.

###### Use SSL
   Should be true, http is not supported.

![PaloAlto Custom Field - ServerUseSsl](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-custom-field-ServerUseSsl-dialog.png)
   ![PaloAlto Custom Field - ServerUseSsl](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-custom-field-ServerUseSsl-validation-options-dialog.png)

###### Device Group
   A semicolon delimited list of Device Groups that Panorama will push changes to (i.e. 'Group 1', 'Group 1;Group 2', or 'Group 1; Group 2', etc.).

![PaloAlto Custom Field - DeviceGroup](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-custom-field-DeviceGroup-dialog.png)
   ![PaloAlto Custom Field - DeviceGroup](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-custom-field-DeviceGroup-validation-options-dialog.png)

###### Inventory Trusted Certs
   If false, will not inventory default trusted certs, saves time.

![PaloAlto Custom Field - InventoryTrustedCerts](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-custom-field-InventoryTrustedCerts-dialog.png)
   ![PaloAlto Custom Field - InventoryTrustedCerts](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-custom-field-InventoryTrustedCerts-validation-options-dialog.png)

###### Template Stack
   Template stack used for device push of certificates via Template.

![PaloAlto Custom Field - TemplateStack](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-custom-field-TemplateStack-dialog.png)
   ![PaloAlto Custom Field - TemplateStack](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/docsource/images/PaloAlto-custom-field-TemplateStack-validation-options-dialog.png)

</details>

## Installation

1. **Download the latest Palo Alto Universal Orchestrator extension from GitHub.**

Navigate to the [Palo Alto Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/paloalto-firewall-orchestrator/releases/latest). Refer to the compatibility matrix below to determine the asset should be downloaded. Then, click the corresponding asset to download the zip archive.

| Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `paloalto-firewall-orchestrator` .NET version to download |
   | --------- | ----------- | ----------- | ----------- |
   | Older than `11.0.0` | | | `net6.0` |
   | Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` |
   | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` || Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` |
   | `11.6` _and_ newer | `net8.0` | | `net8.0` |

Unzip the archive containing extension assemblies to a known location.

> **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net6.0`.

2. **Locate the Universal Orchestrator extensions directory.**

* **Default on Windows** - `C:\Program Files\Keyfactor\Keyfactor Orchestrator\extensions`
    * **Default on Linux** - `/opt/keyfactor/orchestrator/extensions`

3. **Create a new directory for the Palo Alto Universal Orchestrator extension inside the extensions directory.**

Create a new directory called `paloalto-firewall-orchestrator`.
    > The directory name does not need to match any names used elsewhere; it just has to be unique within the extensions directory.

4. **Copy the contents of the downloaded and unzipped assemblies from __step 2__ to the `paloalto-firewall-orchestrator` directory.**

5. **Restart the Universal Orchestrator service.**

Refer to [Starting/Restarting the Universal Orchestrator service](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/StarttheService.htm).

6. **(optional) PAM Integration**

The Palo Alto Universal Orchestrator extension is compatible with all supported Keyfactor PAM extensions to resolve PAM-eligible secrets. PAM extensions running on Universal Orchestrators enable secure retrieval of secrets from a connected PAM provider.

To configure a PAM provider, [reference the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam) to select an extension and follow the associated instructions to install it on the Universal Orchestrator (remote).

> The above installation steps can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/InstallingAgents/NetCoreOrchestrator/CustomExtensions.htm?Highlight=extensions).

## Defining Certificate Stores

### Store Creation

#### Manually with the Command UI

<details><summary>Click to expand details</summary>

1. **Navigate to the _Certificate Stores_ page in Keyfactor Command.**

Log into Keyfactor Command, toggle the _Locations_ dropdown, and click _Certificate Stores_.

2. **Add a Certificate Store.**

Click the Add button to add a new Certificate Store. Use the table below to populate the **Attributes** in the **Add** form.

| Attribute | Description                                             |
   | --------- |---------------------------------------------------------|
   | Category | Select "PaloAlto" or the customized certificate store name from the previous step. |
   | Container | Optional container to associate certificate store with. |
   | Client Machine | Either the Panorama or Palo Alto Firewall URI or IP address. |
   | Store Path | The Store Path field should be reviewed in the store path explanation section.  It varies depending on configuration. |
   | Orchestrator | Select an approved orchestrator capable of managing `PaloAlto` certificates. Specifically, one with the `PaloAlto` capability. |
   | ServerUsername | Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
   | ServerPassword | Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
   | ServerUseSsl | Should be true, http is not supported. |
   | DeviceGroup | A semicolon delimited list of Device Groups that Panorama will push changes to (i.e. 'Group 1', 'Group 1;Group 2', or 'Group 1; Group 2', etc.). |
   | InventoryTrustedCerts | If false, will not inventory default trusted certs, saves time. |
   | TemplateStack | Template stack used for device push of certificates via Template. |

</details>

#### Using kfutil CLI

<details><summary>Click to expand details</summary>

1. **Generate a CSV template for the PaloAlto certificate store**

```shell
    kfutil stores import generate-template --store-type-name PaloAlto --outpath PaloAlto.csv
    ```
2. **Populate the generated CSV file**

Open the CSV file, and reference the table below to populate parameters for each **Attribute**.

| Attribute | Description |
   | --------- | ----------- |
   | Category | Select "PaloAlto" or the customized certificate store name from the previous step. |
   | Container | Optional container to associate certificate store with. |
   | Client Machine | Either the Panorama or Palo Alto Firewall URI or IP address. |
   | Store Path | The Store Path field should be reviewed in the store path explanation section.  It varies depending on configuration. |
   | Orchestrator | Select an approved orchestrator capable of managing `PaloAlto` certificates. Specifically, one with the `PaloAlto` capability. |
   | Properties.ServerUsername | Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
   | Properties.ServerPassword | Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
   | Properties.ServerUseSsl | Should be true, http is not supported. |
   | Properties.DeviceGroup | A semicolon delimited list of Device Groups that Panorama will push changes to (i.e. 'Group 1', 'Group 1;Group 2', or 'Group 1; Group 2', etc.). |
   | Properties.InventoryTrustedCerts | If false, will not inventory default trusted certs, saves time. |
   | Properties.TemplateStack | Template stack used for device push of certificates via Template. |

3. **Import the CSV file to create the certificate stores**

```shell
    kfutil stores import csv --store-type-name PaloAlto --file PaloAlto.csv
    ```

</details>

#### PAM Provider Eligible Fields
<details><summary>Attributes eligible for retrieval by a PAM Provider on the Universal Orchestrator</summary>

If a PAM provider was installed _on the Universal Orchestrator_ in the [Installation](#Installation) section, the following parameters can be configured for retrieval _on the Universal Orchestrator_.

| Attribute | Description |
   | --------- | ----------- |
   | ServerUsername | Palo Alto or Panorama Api User. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |
   | ServerPassword | Palo Alto or Panorama Api Password. (or valid PAM key if the username is stored in a KF Command configured PAM integration). |

Please refer to the **Universal Orchestrator (remote)** usage section ([PAM providers on the Keyfactor Integration Catalog](https://keyfactor.github.io/integrations-catalog/content/pam)) for your selected PAM provider for instructions on how to load attributes orchestrator-side.
> Any secret can be rendered by a PAM provider _installed on the Keyfactor Command server_. The above parameters are specific to attributes that can be fetched by an installed PAM provider running on the Universal Orchestrator server itself.

</details>

> The content in this section can be supplemented by the [official Command documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Certificate%20Stores.htm?Highlight=certificate%20store).

## Release 2.5.1 Update on Alias Constraints
**Important Note** For management jobs, the alias provided for the job is validated to ensure the length of the alias is not longer than Panorama / Firewall allows. For Panorama, alias length **must not** be more than 31 characters. For Firewall, alias length **must not** be more than 63 characters. If your store path points to Panorama, even if you are pushing the certificate to Firewall, you must keep alias length to at most 31 characters. Please see the [Panorama documentation](https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/obtain-certificates/generate-certificate#generate-certificate-pan-os) for more information on certificate name length.

If the alias length exceeds the maximum length, you will receive a job failure with the following error message:
```
Certificate alias 'alias' is too long, it must not be more than 31 characters. Current length: 32.
```

## Release 2.2 Update on Entry Params
**Important Note** Entry params are no longer used.  This version of the extension will only update certs on existing bindings and not add a cert to a new binding location.  This was done to simplify the process since there are so many binding locations and reference issues.

**Important Note** Please review the new path considerations in the section below.  It explains how the paths work for Panorama and the Firewalls.  `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.

## STORE PATH DETAILS AND API SECURITY CONSIDERATIONS
<details>
<summary>Store Path Permutations</summary>

### Store Path Explanation
**Important Note** The store path permutations are show below

#### FIREWALL SHARED SYSTEM PATH
_________________________________
**Path Example** /config/shared

**/config**:
This indicates that the path is within the configuration section of the firewall device. It contains all the configuration settings and parameters for the device.

**/shared**:
This section specifies that the path is within the shared settings. Shared settings are common configurations that can be used across multiple virtual systems (vsys) or contexts within the firewall.
_________________________________

#### FIREWALL VIRTUAL SYSTEM PATH
_________________________________
**Path Example**: /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']

**Note** `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.

**/config**:
This indicates that the path is within the configuration section of the firewall device. It contains all the configuration settings and parameters for the device.

**/devices**:
This part specifies that the configuration relates to devices. In the context of a single firewall, this generally refers to the firewall itself.

**/entry[@name='localhost.localdomain']**:
Note `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.  The entry tag with the attribute @name='localhost.localdomain' identifies a specific device by its name. In this case, it refers to the device named "localhost.localdomain," which is a default or placeholder name for the firewall device.

**/vsys**:
This section specifies that the path is within the virtual systems (vsys) section. Virtual systems allow multiple virtualized instances of firewall configurations within a single physical firewall.

**/entry[@name='vsys1']**:
The entry tag with the attribute @name='vsys1' identifies a specific virtual system by its name. In this case, it refers to a virtual system named "vsys1."
_________________________________

#### PANORAMA SHARED TEMPLATE PATH
_________________________________
**Path Example**: /config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared

**Note** `'locahost.localdomain'` will always be that `constant value` do not make that **anything else!**.

**/config**:
This section indicates that the path is within the configuration section of the Panorama device. It contains all the configuration settings and parameters for the device.

**/devices**:
This part specifies that the configuration relates to devices managed by Panorama. Panorama can manage multiple devices, such as firewalls.

**/template**:
This section indicates that the path is within the templates section. Templates in Panorama are used to define configuration settings that can be applied to multiple devices.

**/entry[@name='CertificatesTemplate']**:
The entry tag with the attribute @name='CertificatesTemplate' identifies a specific template by its name. In this case, it refers to a template named "CertificatesTemplate."

**/config/shared**:
This part of the path indicates that the configuration settings within this template are shared settings. Shared settings are common configurations that can be used across multiple devices or contexts within the Panorama management system.
_________________________________

#### PANORAMA VIRTUAL SYSTEM PATH
__________________________________
**Path Example**: /config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']

**/config**:
This indicates that the path is within the configuration section of the Panorama device. It contains all the configuration settings and parameters for the device.

**/devices**:
This part specifies that the configuration relates to devices managed by Panorama. Panorama can manage multiple devices, such as firewalls.

**/entry**:
This is a generic entry point under devices. However, since it does not have a @name attribute specified at this level, it applies to the broader device category.

**/template**:
This section indicates that the path is within the templates section. Templates in Panorama are used to define configuration settings that can be applied to multiple devices.

**/config/devices**:
This part of the path specifies that the configuration settings within this template apply to devices.

**/entry**:
This again specifies a generic entry point under devices in the context of the template. This would typically be further defined by specific device attributes, but here it leads to the virtual systems (vsys) section.

**/entry[@name='vsys2']**:
The entry tag with the attribute @name='vsys2' identifies a specific virtual system by its name. In this case, it refers to a virtual system named "vsys2."
__________________________________

#### PANORAMA LEVEL
__________________________________
**Path Example**: /config/panorama

**/config**:
This indicates that the path is within the configuration section of the Panorama device. It contains all the configuration settings and parameters for the device.

**/panorama**:
This section specifies that the path is within the Panorama-specific configuration settings. This part of the configuration contains settings that are specific to the Panorama management system itself, rather than the devices it manages.
__________________________________

</details>

<details>
<summary>API User Setup Permissions in Panorama or Firewall Required</summary>

Tab          |  Security Items	
--------------|--------------------------
Xml Api       |Report,Log,Configuration,Operational Requests,Commit,Export,Import
Rest Api      |Objects/Devices,Panorama/Scheduled Config Push,Panorama/Templates,Panorama/Template Stacks,Panorama/Device Groups,System/Configuration,Plugins/Plugins
***

</details>

## Integration Tests

This project includes an [Integration Test](./PaloAlto.IntegrationTests) suite to help run the [test cases](#test-cases) below. Here are the steps to run the integration tests:

- Make sure you have .NET 6 or above installed
- Inside the Integration Tests directory, copy the `.env.test.example` to `.env.test` within the same directory.
- If needed, update the Properties of the file to "Copy always" to the output directory. This ensures the `.env.test` file is visible to the test runner.
- Inside your IDE of choice (Rider / Visual Studio), run the selected tests or run all tests.

## Test Cases
<details>
<summary>Firewall, Panorama Template and Panorama Level</summary>

Case Number|Case Name|Store Path|Enrollment Params|Expected Results|Passed|Screenshots
-------|----------|------------------|--------------------|----------------------------|----|--------
TC1|Firewall Enroll No Bindings|/config/shared|**Alias**: www.certandchain.com **Overwrite**: false|Cert and Chain Installed on Firewall|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC1.gif)
TC1a|Firewall Enroll Template Stack|/config/shared|**Alias**: www.tc1a.com **Overwrite**: false|Error Stating Template Stacks Not Used for Firewall|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC1a.gif)
TC2|Firewall Replace No Bindings|/config/shared|**Alias**: www.certandchain.com **Overwrite**: true|Cert and Chain Installed on Firewall|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC2.gif)
TC3|Firewall Remove Bound Certificate|/config/shared|**Alias**: 0.13757535891685202 **Overwrite**: false|Cert will **not** be removed because bound|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC3.gif)
TC4|Firewall Enroll Bindings|/config/shared|**Alias**:0.13757535891685202 **Overwrite**: false|Will not replace cert since Overwrite=false|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC4.gif)
TC5|Firewall Replace Bound Certificate|/config/shared|**Alias**:0.13757535891685202 **Overwrite**: true|Will replace cert bindings get automatically updated since Overwrite=true|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC5.gif)
TC6|Firewall Inventory|/config/shared|N/A|Inventory will finish and certs from shared location inventoried.|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC6.gif)
TC6a|Firewall Inventory No Trusted Certs|/config/shared|N/A|Inventory will finish no Trusted Certs and certs from shared location inventoried.|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC6.gif)
TC7|Firewall Inventory With Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|N/A|Will Inventory all certificates from vsys1 on firewall|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC7.gif)
TC8|Firewall Enroll cert and chain to Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|**Alias**: www.ejbcacertandchain.com|Cert is installed along with chain.|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC8.gif)
TC9|Firewall Remove unbound cert from Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|N/A|Will remove cert from test case 8 from Firewall Virtual System|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC9.gif)
TC10|Firewall Remove bound cert from Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|**Alias**: 0.8168##|Cert will not be removed because it is bound.|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC10.gif)
TC11|Firewall Replace without Overwrite on Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|**Alias**: 0.8168## **Overwrite**: true|User is warned Overwrite needs checked.|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC11.gif)
TC12|Firewall Renew cert on Shared and Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1'] and /config/shared|**Alias**: www.renewtester.com|Cert renewed on vsys and shared locations|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC12.gif)
TC13|Firewall Replace bound cert on Virtual System|/config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']|**Alias**: 0.8168## **Overwrite**: true|Cert will be replaced and binding updated on vsys.|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC13.gif)
TC14|Panorama Template Enroll Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**: www.pantemptc1.com|Certificate is enrolled to shared location for template|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC14.gif)
TC14a|Panorama Invalid Template Stack|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**: www.tc14a.com|Error Occurs with list of valid Template Stacks To Use|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC14a.gif)
TC15|Panorama Template Replace Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**: www.pantemptc1.com **Overwrite**: true|Certificate is replaced in shared location for template|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC15.gif)
TC16|Panorama Template Remove unbound Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**: www.pantemptc1.com|Certificate is removed from shared location for template|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC16.gif)
TC16a|Panorama Template Stack Push|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**: www.tc16a.com|Certificate pushed to Template and Template Stack|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC16a.gif)
TC16c|Panorama Multiple Device Group Push|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**: com.example.devicegroup|Certificate pushed to Template and Device Groups|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC16c.gif)
TC17|Panorama Template Replace bound Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**: LongNameTest **Overwrite**: true|Certificate is replaced, binding updated in shared location for template|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC17.gif)
TC18|Panorama Template Remove bound Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**: LongNameTest|Certificate is not removed because it is bound|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC18.gif)
TC18b|Panorama Template Remove multiple device groups bound Certificate|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|**Alias**: com.example.devicegroup|Certificate is removed|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC18b.gif)
TC19|Panorama Template Shared Inventory|/config/devices/entry[@name='localhost.localdomain']/template/entry[@name='CertificatesTemplate']/config/shared|N/A|Certificates are inventoried from this location|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC19.gif)
TC20|Panorama Template Virtual System Inventory|/config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']|N/A|Certificates are inventoried from this template vsys location|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC20.gif)
TC21|Panorama Template Virtual System Enroll Certificate|/config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']|**Alias**: www.vsys2enroll.com|Certificate is enrolled to vsys2 location for template|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC21.gif)
TC21a|Panorama Level Inventory No Trusted Certs|/config/panorama|N/A|Certificates are inventoried from this location No Trusted Certs|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC21a.gif)
TC22|Panorama Template Virtual System Replace unbound Certificate|/config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']|**Alias**: www.vsys2enroll.com|Certificate is replaced in vsys2 location for template|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC22.gif)
TC23|Panorama Template Virtual System Remove unbound Certificate|/config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']|**Alias**: www.vsys2enroll.com|Certificate is removed in vsys2 location for template|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC23.gif)
TC24|Panorama Template Virtual System Renew bound Certificate|/config/devices/entry/template/entry[@name='CertificatesTemplate']/config/devices/entry/vsys/entry[@name='vsys2']|**Alias**: www.vsys2enroll.com|Certificate is renewed, binding updated in vsys2 location for template|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC24.gif)
TC25|Panorama Level Inventory|/config/panorama|N/A|Certificates are inventoried from this location|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC25.gif)
TC26|Panorama Level Enroll Cert and Chain|/config/panorama|**Alias**: www.panlevelcertandchain.com|Panorama Level Install Cert and Chain|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC26.gif)
TC27|Panorama Level Enroll Cert overwrite warning|/config/panorama|**Alias**: www.panlevelcertandchain.com **Overwrite**: false|Cert is not installed warned Overwrite is needed|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC27.gif)
TC28|Panorama Level Replace Cert|/config/panorama|**Alias**: www.panlevelcertandchain.com **Overwrite**: true|Cert is replaced because Overwrite was used|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC28.gif)
TC29|Panorama Level Remove unbound Cert|/config/panorama|N/A|Cert is removed because not bound|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC28.gif)
TC30|Panorama Level Replace bound Cert|/config/panorama|**Alias**: PanoramaNoPK **Overwrite**: true|Cert is replaced, binding updated|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC30.gif)
TC31|Firewall previous version cert store settings|/config/shared|**Alias**: www.extraparams.com **Overwrite**: false|Cert is still installed because it ignores extra params|True|![](https://raw.githubusercontent.com/Keyfactor/paloalto-firewall-orchestrator/main/images/TC31.gif)
</details>

## License

Apache License 2.0, see [LICENSE](LICENSE).

## Related Integrations

See all [Keyfactor Universal Orchestrator extensions](https://github.com/orgs/Keyfactor/repositories?q=orchestrator).

paloalto-firewall-orchestrator

paloalto-firewall-orchestrator Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

paloalto-firewall-orchestrator

paloalto-firewall-orchestrator Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README