Palo Alto Networks Firewall: nShield HSM Integration Guide

Familiarize yourself with:

• Installation Guide and User Guide for your HSM.

• nShield Remote Administration User Guide .

• Security World v12.40 Compatibility Package v1.1.0 Release Notes

• PAN-OS® 10.1 Administrator’s Guide

The following preparations need to be made before starting to use Entrust products:

• Each HSM uses a remote file system (RFS). You can configure the RFS on any computer running nShield Security World software.

• The RFS computer can also be used as a client to the HSM, to allow presentation of smart cards using nShield Remote Administration, an optional product. For information, see the nShield Remote Administration User Guide .

• A correct quorum for the Administrator Card Set (ACS).

  • For creating the Security World, determine who within the organization will act as custodians of the ACS.

  • Obtain enough blank smart cards to create the Administrator Card Set (ACS).

• Operator Card Set (OCS), Softcard, or Module-Only protection.

  • If OCS protection is to be used, a 1-of-N quorum must be used.

• Firewall configuration with usable ports:

  • 9004 for the HSM nfast server (hardserver).

  • 8200 for the Firewall.

Furthermore, the Security World parameters have to be defined. For details of the security implications of the choices, see the nShield Security Manual :

• Whether your Security World must comply with FIPS 140-2 Level 3 standards.

  • If using FIPS Restricted mode, it is advisable to create an OCS for FIPS authorization. The OCS can also provide key protection for the Firewall master key. For information about limitations on FIPS authorization, see the Installation Guide of the nShield HSM.

• Whether to instantiate the Security World as recoverable or not.

The following preparations need to be made before starting to use the Palo Alto Networks Firewall:

• Obtain a Palo Alto Networks customer support account. This account is required to have access to the latest software releases.

• Procure a Palo Alto Networks Firewall appliance, or set up the Firewall in a bare-metal computer. A virtual machine (VM) can also be used. This guide was tested using a VMWare ESXi virtual machine.

• Upgrade the Firewall installation software with the latest package to be tested.

• The nShield RFS version must be compatible with the Palo Alto Networks Firewall, see Product configurations .

1. Check the software version of the RFS by running the ncversions command.

2. If the software is older than v12.60.11 , upgrade it. For instructions, see the User Guide for your HSM.

The v12.40 Compatibility Package must be installed on the RFS. For instructions, see the Security World v12.40 Compatibility Package v1.1.0 Release Notes .

At the RFS command prompt, run new-world-1240 .

For information on the command, see the Security World v12.40 Compatibility Package v1.1.0 Release Notes .

The HSM authenticates the Firewalls based on their IP addresses. Therefore, you must configure the Firewalls to use static IP addresses. Dynamic addresses, assigned through DHCP, cannot be used.

If you want to set up connectivity to more than one HSM for high-availability, do it at this point. If more than one HSM is being used, the HSMs must share the same v2 security world. For steps on loading an existing security world onto an HSM, see the nShield Connect User Guide . Adding more HSMs after the master key has been encrypted and stored in an HSM (see Encrypt the master key using the HSM ) is only possible by first removing the master key from the HSM. The master key is needed to perform the removal. Then encrypt and store the master key again in the HSM after adding new HSM to the list above.

1. Sign in to the Palo Alto Networks Firewall web interface, and select Device > Setup > HSM .

2. Edit the Hardware Security Module Provider settings and set the Provider Configured to nCipher nShield Connect .

3. Add each HSM as follows. A high-availability HSM configuration requires at least two HSMs.

   1. Enter a Module Name for the HSM. This can be any ASCII string of up to 31 characters.

   2. Enter an IPv4 address for the HSM.

   3. Repeat steps a and b for all HSMs.

4. Enter an IPv4 address for the RFS.

5. Select OK .

6. Select the Commit icon, shown with a red arrow in the following picture.

Perform these optional steps if you do not want the Firewall to connect through the default management interface. If you are connecting through the default management interface, go to Register the Firewall as an HSM client .

1. Select Device > Setup > Services , then select Service Route Configuration .

2. Select Customize a service route .

   The IPv4 tab is active by default.

3. For Service , select HSM .

4. Select a Source Interface for the HSM.

5. Select OK .

6. Select the Commit icon.

This can be done from the front panel of the HSM or from the RFS. These steps describe how to register the firewall as an HSM client from the RFS command line.

1. On the RFS, change to the HSM-specific directory to obtain the HSM configuration file and create a new configuration file:

   cd /opt/nfast/kmdata/hsm-<HSM-ESN>/config/
   
   touch config.new
   
   cp config config.new

2. Edit config.new :

   vi config.new

3. Add the following to the [hs_clients] section:

   addr=<Firewall-IP>
   clientperm=priv
   keyhash=0000000000000000000000000000000000000000
   esn=
   timelimit=0
   datalimit=0
   -----

4. Push config.new to the HSM:

   cfg-pushnethsm --address=<HSM-IP> config.new

5. Update the config file with the changes made:

   > cp config.new config

6. Repeat these steps for each HSM in the high-availability configuration.

1. Log in to the RFS.

2. Assume root privileges by running the su command:

   su

3. Configure or disable the RFS firewall:

   service firewalld stop

   Note	The RFS firewall is independent of the Palo Alto Networks Firewall.

   Note	An RFS reboot re-enables the RFS firewall.

4. Verify that the RFS firewall stopped:

   service firewalld status

5. Set up the RFS. This command must be run for each HSM being added to your high-availability configuration:

   rfs-setup --force <HSM_IP_address> $(anonkneti <HSM_IP_address>)

6. Run the following command to permit HSM client submissions on the RFS:

   rfs-setup --gang-client --write-noauth <Firewall-IP-address>

You can use the following commands to configure the RFS to accept connections from the client Firewall. rfs-setup is run on the RFS, and rfs-sync is run on the client:

For security reasons, the Firewall has a protected command-line interface that does not allow direct access to rfs-setup and rfs-sync in its built-in nfast server. Instead, equivalent commands are available in the protected Palo Alto Networks Firewall command-line interface, and can be useful for debugging.

1. In the Palo Alto Networks Firewall web interface, select Device > Setup > HSM > Setup Hardware Security Module .

2. Select OK .

   The Firewall authenticates to the HSM and displays a completion message:

3. Select OK .

1. In the Palo Alto Networks Firewall web interface, select Device > Setup >HSM > Synchronize with Remote Filesystem .

   The Firewall synchronizes with the RFS and displays a completion message:

2. Select OK .

1. In the Palo Alto Networks Firewall web interface, select Device > Setup > HSM .

2. Check the Hardware Security Module Status . It should be Authenticated .

   • Name - The name of the HSM.

   • IP address - The IP address of the HSM.

   • Module State - The current state of the HSM connection: Authenticated or NotAuthenticated .

3. Check the connection status:

   • Green - The Firewall is successfully authenticated and connected to the HSM.

   • Red - The Firewall failed to authenticate to the HSM, or network connectivity to the HSM is down.

     Note	A left-over rfs-sync lock from a failed attempt could cause red status. Launch a command-line interface on the RFS, remove the /opt/nfast/kmdata/local/.nft-lock file, then re-run the instructions in Synchronize the Firewall with the RFS .

Use this procedure for first time encryption of a key, or if you define a new master key and you want to encrypt it.

1. In the Palo Alto Networks Firewall web interface, select Device > Master Key and Diagnostics .

2. Select the gear icon next to Master Key .

3. Select the Master Key check box.

4. In the Current Master Key field, enter the key that is currently used to encrypt all of the private keys and passwords on the Firewall (if applicable).

5. Select the Stored on HSM check box.

6. Enter the new master key and confirm.

7. Enter the following information:

   • Life Time - The number of days and hours after which the master key expires (1-18250 days).

   • Time for Reminder - The number of days and hours before expiration when the user is notified of the impending expiration (1–365 days).

8. Select OK , then select Commit .

The Master Key information is updated.

The new key is also visible in Device > Setup > HSM > Hardware Security Module Details .

Refresh the master key encryption by rotating the wrapping key that encrypts it. The wrapping key resides on the HSM.

1. Sign in to the Palo Alto Networks Firewall command-line interface.

2. Use the following command to rotate the wrapping key for the master key on an HSM:

   request hsm mkey-wrapping-key-rotation

   For example:

   admin@PA-VM> request hsm mkey-wrapping-key-rotation
   Mkey wrapping key rotation succeeded.
   New key handle 1119.
   admin@PA-VM>

The mkey-wrapping-key-rotation command does not delete the old wrapping key.

• If the master key is encrypted on the HSM, the command generates a new wrapping key on the HSM and encrypts the master key with the new wrapping key.

• If the master key is not encrypted on the HSM, the command generates a new wrapping key on the HSM for future use.

This section describes a method to generate a self-signed certificate and key for purposes of this guide using the HSM. This is the preferred method to generate such key and certificate. For information about importing existing keys and certificates, see the User Guide for your HSM.

The HSM generatekey command generates a key file with the same syntax as an RSA private key file, but contains the key identifier rather than the key itself, which remains protected in the HSM.

1. Log in to the RFS.

2. Assume root privileges by running the su command:

   su

3. Run the generatekey command:

   cd /opt/nfast/kmdata/local
   generatekey pkcs11 selfcert=yes

   For example, with softcard protection:

   [root@red_hat_8_rfs local]# generatekey pkcs11 selfcert=yes
   module: Module to use? (1, 2) [1] >
   protect: Protected by? (token, softcard, module) [token] > softcard
   recovery: Key recovery? (yes/no) [yes] >
   type: Key type? (DES3, DH, DHEx, DSA, HMACSHA1, HMACSHA256, HMACSHA384,
   HMACSHA512, RSA, DES2, AES, Rijndael, Ed25519, X25519) [RSA]
   >
   size: Key size? (bits, minimum 1024) [2048] >
   OPTIONAL: pubexp: Public exponent for RSA key (hex)? []
   >
   plainname: Key name? [] > paloaltossl
   x509country: Country code? [] > US
   x509province: State or province? [] > FL
   x509locality: City or locality? [] > Sunrise
   x509org: Organization? [] > SWTesting
   x509orgunit: Organization unit? [] > InterOp
   x509dnscommon: Domain name? [] > paloaltofirewall
   x509email: Email address? [] > [email protected]
   nvram: Blob in NVRAM (needs ACS)? (yes/no) [no] > no
   digest: Digest to sign cert req with? (md5, sha1, sha256, sha384, sha512)
   [default sha256] >
   key generation parameters:
   operation      Operation to perform            generate
   application    Application                     pkcs11
   module         Module to use                   1
   protect        Protected by                    softcard
   softcard       Soft card to protect key        <softcard-name>
   recovery       Key recovery                    yes
   verify         Verify security of key          yes
   type           Key type                        RSA
   size           Key size                        2048
   pubexp         Public exponent for RSA key (hex)
   plainname      Key name                        HSMKey
   x509country    Country code                    US
   x509province   State or province               FL
   x509locality   City or locality                Sunrise
   x509org        Organization                    SWTesting
   x509orgunit    Organization unit               InterOp
   x509dnscommon  Domain name                     paloaltofirewall
   x509email      Email address                   [email protected]
   nvram          Blob in NVRAM (needs ACS)       no
   digest         Digest to sign cert req with    sha256
   Please enter the pass phrase for softcard '<softcard-name>':
   
   Please wait........
   Key successfully generated.
   Path to key: /opt/nfast/kmdata/local/key_pkcs11_ua5efdb72cb623c41d6ec9baeacc1eac95be8ada2b
   Path to self-cert: /opt/nfast/kmdata/local/pkcs11_ua5efdb72cb623c41d6ec9baeacc1eac95be8ada2b_selfcert
   [root@red_hat_8_rfs local]#

   1. If you selected token for OCS protection, you must provide the OCS 1/N quorum for fips-auth . If you provide the ACS quorum, the generatekey command will fail.

   2. If you selected module for module protection, you need to provide either the ACS or OCS 1/N quorum to provide fips-auth for this HSM operation.

4. Two files are created. The key file has the same syntax as an RSA private key file, but actually contains the key identifier rather than the key itself, which remains protected. The file type and naming are:

   File Type	Naming
   Key file (key identifier rather than the key itself)	key_pkcs11_…​
   Self-signed certificate	pkcs11_…​_selfcert

5. You can view the content of the certificate created above by viewing the self-signed certificate ( .crt ):

   openssl x509 -text -noout
   -in /opt/nfast/kmdata/local/pkcs11_ua5efdb72cb623c41d6ec9baeacc1eac95be8ada2b_selfcert

1. In the Palo Alto Networks Firewall web interface, and select Device > Setup > HSM .

2. In the Hardware Security Operations settings, select Synchronize with Remote Filesystem .

   The Firewall confirms when the synchronization is complete.

1. Sign in to the Palo Alto Networks Firewall web interface from the RFS.

2. Launch the browser from the RFS to be able to upload files from the RFS files system to the Palo Alto Networks Firewall.

3. Select Device > Certificate Management > Certificates > Device Certificates

4. Select Import .

5. For Certificate Type , select the Local option.

6. Enter the Certificate Name .

7. Browse to the Certificate File on the RFS. This is the file ending in _selfcert from the certificate generated in the previous step.

   /opt/nfast/kmdata/local/pkcs11_ua5efdb72cb623c41d6ec9baeacc1eac95be8ada2b_selfcert

8. From the File Format list, select Base64 Encoded Certificate (PEM) .

9. Select the Private key resides on Hardware Security Module check box.

10. Select OK .

11. Select the Commit icon and close the dialog box.

A new certificate has been imported:

1. In the Firewall web interface, open the certificate that you have imported: select Device > Certificate Management > Certificates > Device Certificates .

2. Select the certificate to open it.

3. Select the Forward Trust Certificate check box.

4. Select OK .

5. Commit your changes.

The USAGE column now shows Forward Trust Certificate .

1. Locate the certificate that you have just imported.

2. Check the icon in the KEY column:

   • Lock icon — The private key for the certificate is on the HSM.

   • Error icon — The private key is not on the HSM or the HSM is not properly authenticated or connected.

3. Check the USAGE column. It should be Forward Trust Certificate .