>
    Strata Copilot
    Create a Cisco ASA Machine
    Focus
    Focus
    1. Home
    2. Next‑Gen Trust Security
    3. Next-Gen Trust Security
    4. Next-Gen Trust Security Overview
    5. Welcome to Installations
    6. About Machines
    7. Create a New Machine
    8. Create a Cisco ASA Machine
    Next‑Gen Trust Security

    Create a Cisco ASA Machine

    Table of Contents

    Create a Cisco ASA Machine

    Note (Preview feature): This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.
    Creating a machine for a Cisco Adaptive Security Appliance (ASA) firewall lets Next-Gen Trust Security discover and provision the identity certificates that serve its remote-access VPN and management interfaces. Next-Gen Trust Security connects to the firewall's HTTPS management interface. It doesn't use the ASA REST API agent, so you don't need to install it. After you create the machine, you can provision certificates to it.

    Before You Begin

    • The hostname or IP address of the Cisco ASA management interface. IPv6 addresses are supported.
    • The HTTPS management port, if it isn't 443.
    • At least one active VSatellite connection that can reach the Cisco ASA management interface on that port.
    • A local Cisco ASA account with privilege level 15. Provisioning runs configuration commands, so it requires privilege level 15. Which commands a lower-privilege account can run for discovery depends on the firewall's own command-privilege settings.
    • For a firewall in multiple-context mode, one machine for each security context you want to manage. Each machine addresses exactly one security context.
    Note: Next-Gen Trust Security doesn't verify the certificate that the Cisco ASA management interface presents, because that certificate is self-signed by default. The connection is still encrypted.

    Prepare the Cisco ASA

    Run these commands on the Cisco ASA command-line interface (CLI) to give Next-Gen Trust Security access to the HTTPS management interface. Replace the values in angle brackets with your own.
    1. Create a local account with privilege level 15:
      username <username> password <password> privilege 15
    2. Turn on the HTTPS server. If you use a port other than 443, add it to the command.
      http server enable
    3. Allow the VSatellite network to reach the management interface:
      http <vsatellite-network> <mask> <interface-nameif>
    4. Authenticate HTTPS management connections against the local user database:
      aaa authentication http console LOCAL
    5. Save the configuration:
      write memory

    Create the Machine

    1. In Server Hostname, enter the hostname or IP address of the Cisco ASA management interface.
    2. (Optional) In Port, enter the HTTPS management port. If you leave it empty, Next-Gen Trust Security uses 443.
    3. For Credential Type, choose one of the following:
      • Enter Credentials to enter the Cisco ASA account's username and password.
      • Select Credentials to use shared credentials from CyberArk.
      Note: Credential types require additional licensing. Only users with the CyberArk shared credential capability see this option.
      Important: Your role can limit which credentials you see. System Administrators and PKI Administrators can select any credential. Users with the Resource Owner role can use only the credentials that belong to their teams.
    4. Enter the credentials for the method you chose:
      • If you chose Enter Credentials, enter the Username and Password of the Cisco ASA account.
      • If you chose Select Credentials, for Credential, choose the shared credential that holds the account's username and password.
      Warning:
      Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.
    5. (Optional) In Security Context, for a firewall in multiple-context mode, enter the name of the security context that owns the Server Hostname. Leave it empty for a single-context firewall. The name can contain only letters, digits, periods (.), underscores (_), and hyphens (-), up to 64 characters.
      Note: Next-Gen Trust Security doesn't send this value to the firewall. It records it on the machine's installations. If you change it later, the next discovery reports every installation on the machine as new.
    6. Click Test Access, then click Continue. Continue is enabled only after the test succeeds.
      Note: The test passes if the Cisco ASA accepts the credentials, even when the account's privilege level is below 15. Provisioning fails with an account below privilege level 15.
    Tip: The Cisco ASA allows six concurrent HTTPS management sessions for each security context, shared with the Adaptive Security Device Manager (ASDM) and other management clients. If connections are refused intermittently, close other management sessions, and avoid running discovery and provisioning against the same firewall at the same time.

    What's Next?

    Refer back to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling. When you configure discovery, you can set these options:
    • Exclude Expired Certificates skips certificates that have already expired.
    • Exclude Trust Pool Certificates skips the CA certificates in the Cisco ASA trust pool. When this option is off, discovery also reports trust pool certificates so you can track when they expire. Next-Gen Trust Security doesn't renew trust pool certificates. If discovery on a firewall with a large trust pool doesn't finish, turn this option on.
    For existing machines:

    © 2026 Palo Alto Networks, Inc. All rights reserved.