Set Up Connectivity with a Thales Luna Network HSM

1. Log in to the firewall web interface.
2. Define connection settings for the Thales Luna Network HSM.

   1. Select DeviceSetupHSM, and Edit the Hardware Security Module Details settings.
   2. For Provider Configured, select Thales Luna Network HSM.
   3. Add each HSM server.

      A high-availability HSM configuration requires at least two servers; you can cluster up to 16 HSM servers. All servers in the cluster must run the same Luna HSM version and authenticate separately. Use a Luna Network cluster only when you want to replicate the keys across the cluster.

      Alternatively, you can add up to 16 Luna Network HSM servers that function independently.

      If you configure two or more HSM servers, enable High Availability; otherwise, the firewall does not use the additional HSM servers.

      1. Enter a Module Name (up to 31 ASCII characters).
      2. Enter the IPv4 Server Address.
   4. (HA only) Enable High Availability, and then configure the following settings:

      • Auto Recovery Retry—Enter the maximum number of times the HSM client tries to recover its connection to an HSM server before failing over to a peer server (range is 0-500; default is 0)
      • High Availability Group Name—Enter a name for the HA group (up to 31 ASCII characters)
   5. Click OK and Commit your changes.
3. (PAN-OS 12.1.7 and earlier) Select an HSM Client Version:

   • 5.4.2
   • 7.2.0
4. Click OK and Commit your changes.
5. (Optional) Configure a service route to connect to the HSM if you don’t want the firewall to connect through the management interface (default).

   If you configure a service route for the HSM, running the clear session all CLI command clears all existing HSM sessions, which brings all HSM states down and then up again. During the several seconds required for recovery, all SSL/TLS operations fail.

   1. Select DeviceSetupServices and click Service Route Configuration.
   2. Customize a service route. The IPv4 tab is active by default.
   3. Click HSM in the Service column.
   4. Select a Source Interface for the HSM.
   5. Click OK and Commit your changes.
6. Configure the firewall to authenticate to the HSM.

   1. Select DeviceSetup and Setup Hardware Security Module.
   2. Select the HSM Server Name.
   3. Select Automatic or Manual for your authentication and trust certificate.
   4. Enter the Administrator Password to authenticate the firewall to the HSM.
   5. Click OK.

      The firewall tries to authenticate to the HSM and displays a status message.
   6. Click OK again.
7. Register the firewall as an HSM client and assign it to a partition on the HSM server.

   If a client (firewall) with the same <cl-name> is already registered on the HSM, you must delete the duplicate registration before registering the new client. Run the client delete -client <cl-name> command, where <cl-name> is the name of the registered client you want to delete.

   1. Log in to the HSM from a remote system.
   2. Register the firewall using the client register -c <cl-name> -ip <fw-ip-addr> CLI command, where <cl-name> is the name you assign to the firewall for use on the HSM and <fw-ip-addr> is the IP address for that firewall.
   3. Assign a partition to the firewall using the client assignpartition -c <cl-name> -p <partition-name> CLI command, where <cl-name> is the name you assigned to the firewall using the client register command and <partition-name> is the name of a previously configured partition that you want to assign to this firewall.
8. Configure the firewall to connect to the HSM partition.

   1. Select DeviceSetupHSM and refresh (

      ) the display.
   2. Setup HSM Partition (Hardware security operations settings).
   3. Enter the Partition Password to authenticate the firewall to the partition on the HSM.
   4. Click OK.
9. (HA only) Repeat the previous authentication, registration, and partition connection steps to add another HSM to the existing HA group.

   If you remove an HSM from your configuration, repeat the previous partition connection step to remove the deleted HSM from the HA group.
10. Verify firewall connectivity and authentication with the HSM.

    1. Select DeviceSetupHSM and check the authentication and connection Status:

       • Green—The firewall successfully authenticated and connected to the HSM.
       • Red—The firewall failed to authenticate or connect to the HSM.
    2. View the following columns in Hardware Security Module Status to determine the authentication status:

       • Serial Number—The serial number of the HSM partition if the firewall successfully authenticated to the HSM.
       • Partition—The partition name on the HSM assigned to the firewall.
       • Module State—The current state of the HSM connection. This value is always Authenticated if the Hardware Security Module Status displays the HSM.