Prepare Your Firewall for Device Security in a China Tenant

1. From the NGFW admin CLI, enter configure mode and set the device-telemetry region to cn.

   configure
   set deviceconfig system device-telemetry region cn
   commit

2. Obtain the China certificate chain.

   Certificate	Description	Cert Level
   pan-86-root-ca2-g1.crt	Prisma Access China Root CA G1	Root CA
   86-services-intermediate-ca2-g1.crt	Prisma Access China Services Intermediate G1	Intermediate cert
   86-intermediate-ca2-g1.crt	Prisma Access China Client Intermediate G1	Intermediate cert
   65-services-issuing-ca2-g2.crt	Prisma Access China (Singapore) Services Issuing G2	Service issuing cert
   86-services-issuing-ca2-g2.crt	Prisma Access China (Beijing) Services Issuing G2	Service issuing cert

3. Import the China certificate chain.

   When you import pan-86-root-ca2-g1.crt, select Trusted Root CA.

4. Create a certificate profile that includes the imported certificates.

   1. Select DeviceCertificate ManagementCertificate Profile and Add a profile.
   2. Enter a Name for the profile.
   3. Add all five certificates that you imported in the previous step to the profile.
   4. Click OK and Commit the changes.
5. Configure the logging-service parameters from the NGFW admin CLI.

   1. Set the certificate profile for the logging receiver. Replace profile_name with the name of the certificate profile that you created in the previous step.

      set logging-service-params update lcaas-certificate-profile profile_name
      set logging-service-params update lcaas-region cn

   2. Set the registry/orch FQDN and port.

      set logging-service-params update orchestrator-domain registry-prd1.cn1.no1.cdl.prismaaccess.cn
      set logging-service-params update orchestrator-port 443

   3. Verify each parameter.

      set logging-service-params show lcaas-certificate-profile china-cert-chain
      set logging-service-params show lcaas-region cn
      set logging-service-params show orchestrator-domain registry-prd1.cn1.no1.cdl.prismaaccess.cn
      set logging-service-params show orchestrator-port 443

6. Install the device certificate or fetch the certificate using the NGFW admin CLI.

   Optional Fetch the device certificate using the NGFW admin CLI.

   request certificate fetch OTP

   Verify the device certificate information, and confirm that the certificate is signed by China (CN) or Singapore (SG).

   show device-certificate info

7. Optional On a VM-Series firewall, retrieve the license from the license server under LicensesLicense Management.

   After the firewall retrieves the license key, the Strata Logging Service portion of the license becomes active and the device certificate is available for use.
8. Fetch the logging-service customer information.

   From the firewall admin CLI:

   request logging-service-forwarding customerinfo fetch

   If the log receiver doesn't work, restart the logging receiver process:

   debug software restart process log-receiver

9. Enable Cloud Logging for the China region from the web interface.

   1. Select DeviceSetupCloud Logging and click the Gear icon to edit the settings.
   2. For Region, select China from the list.
   3. Click OK and Commit.
10. Verify logging-service forwarding from the NGFW admin CLI.

    request logging-service-forwarding status

    In the output, confirm that the Region is China and the Status is success.
11. Verify Enhanced Application Log (EAL) connectivity.

    From the NGFW admin CLI:

    show iot eal conn

    Confirm that both the management plane and data plane cloud connections report as successful. If any connection fails, contact Palo Alto Networks Support.