GlobalProtect (Palo Alto) Integration

• Export your Palo Alto Forward Trust CA certificate, including its private key, so you can use it to sign Lumia’s CA.
  Never share this file with anyone (including Lumia), and delete it immediately after completing this step.
  To export the certificate:
• Go to DEVICE → Certificate Management → Certificates
• Identify the certificate marked with Forward Trust Certificate in the USAGE column
• Click Export Certificate



• Check Export Private Key, choose a passphrase for the exported file, click OK. The file will be downloaded to your Downloads folder with a name such as palo.pem. Never share the exported PEM file or its passphrase with anyone.

• Open a terminal or command prompt.
• Create a ca.ext certificate extension configuration file that defines the permissions granted to the Lumia certificate (add any additional extension your organization may require):

basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, keyCertSign, cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer

• Place lumia.csr, ca.ext, and palo.pem in the same directory, then run the following command to sign (-days 365 defines the number of days the certificate will remain valid and can be set to any value):

openssl x509 -req -in lumia.csr -CA palo.pem -CAkey palo.pem -out lumia.crt -days 365 -sha256 -extfile ca.ext

• You will be prompted to enter the private key’s password (the password you provided when exporting the private key in the previous steps).
• If the process completes successfully, a file named lumia.crt will be created. Please share this file with Lumia at support@lumia.security to proceed with the integration.

• Go to POLICIES → Decryption → Pre Rules, then click Add.

• In the General tab:
• Set Name to decrypt-lumia-proxy.
• In the Source tab:
• Select Any for SOURCE ZONE.



• In the Destination tab:
• Select Any for DESTINATION ZONE.
• Click Add under DESTINATION ADDRESS.
• Click New Address.



• In the Address window:
• Set Name to Lumia Proxy.
• Set Type to FQDN.
• Set FQDN to your Lumia Proxy FQDN.
• Click OK.



• In the Options tab:
• Set Action to Decrypt.



• Click OK to create the decryption rule.

• Go to OBJECTS → Security Profiles → URL Filtering, then click Add.

• Set Name to Add X-Authenticated-User.
• Select the HTTP Header Insertion, then click Add.

• In the HTTP Header Insertion window:
• Set Type to Custom.
• Set Name to X-Authenticated-User (skip this block if already exists.)
• Click Add Domains.
• Set * to catch all domains.
• Click Add Headers.



• In the Headers window:
• Set Header to X-Authenticated-User
• Set Value to ($user)@($domain)



• Click OK three times to create the URL Filtering Rule.

• Go to POLICIES → Security → Pre Rules, then click Add.

• In the General tab:
• Set Name to Allow access to Lumia Proxy.
• In the Source tab:
• For SOURCE ZONE, select the zone used by your VPN users. If your are not sure, it is ok also acceptable to select Any.



• In the Destination tab:
• Set DESTINATION ZONE to Any.
• Set DESTINATION ADDRESS to the Lumia Proxy Address object you created in Step 2.



• In the Actions tab:
• Set Action to Allow.
• Set Profiles Type to Profiles.
• Set URL Filtering to the Add X-Authenticated-User profile you created in Step 3.



• Click OK to create the security policy rule.
• Security rules are evaluated from top to bottom, so ensure the newly added rule is matched before any broader rules. If you are unsure, and because the rule is very specific, you can move it to the top of the list by clicking Move Top.

• Go to NETWORK → GlobalProtect → Portal, then click the relevant GlobalProtect profile.

• Click the Agent tab, then click the relevant Agent Config profile.

• In the Configs window:
• Select the App tab.
• In the App Configuration pane, look for Proxy Auto-Configuration (PAC) File URL, then set it to the Lumia PAC URL.

• Click OK two times to update the GlobalProtect to push Lumia’s PAC.