> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Palo Alto Networks connection

> Learn how to configure a Palo Alto Networks connection for Infisical.

A Palo Alto Networks connection authenticates Infisical to a PAN-OS firewall or a Panorama with the username and password of a PAN-OS administrator, so [Palo Alto Networks certificate syncs](/docs/documentation/platform/pki/applications/certificate-syncs/overview) can import certificates and commit the changes.

> [!NOTE]
>
> This guide only authenticates Infisical with your Palo Alto Networks device. Once the app connection is ready, you can [use it to set up integrations](#step-3-configure-integrations).

## Prerequisites

* A PAN-OS administrator account with the **Superuser** role on the firewall or Panorama, so you can create an Admin Role profile and another administrator
* Network access from Infisical to the device's management interface over HTTPS, either directly or through an [Infisical Gateway](/docs/documentation/platform/gateways/overview.md)

## Step 1: Create a dedicated PAN-OS administrator

The connection signs in as a PAN-OS administrator that can use the XML API. Create a dedicated account for it, because each sync commits every pending change made with that account, including a person's unfinished edits.

**Step 1**

In the PAN-OS web interface, go to **Device** > **Admin Roles** and select **Add**. On a Panorama, go to **Panorama** > **Admin Roles** instead.

**Step 2**

Enter a **Name** for the profile. On the **XML API** tab, enable only **Configuration**, **Operational Requests**, **Commit**, and **Import**.

**Step 3**

On the **Web UI** and **REST API** tabs, disable every item, because the connection uses neither one. Then select **OK**.

**Step 4**

Go to **Device** > **Administrators** (or **Panorama** > **Administrators** on a Panorama) and select **Add**.

**Step 5**

Enter a **Name** and **Password** for the account. Set **Administrator Type** to **Role Based** and select the Admin Role profile you created as the **Profile**. Then select **OK**.

**Step 6**

Commit the changes.

## Step 2: Create the app connection

Next, create the app connection in Infisical.

> [!TIP]
>
> To create the connection using the API, use the [Create Palo Alto Networks Connection](/docs/api-reference/endpoints/app-connections/palo-alto-networks/create.md) endpoint.

**Step 1**

In Certificate Manager, go to **Settings** > **App Connections** and select **Add Connection**.

**Step 2**

Select **Palo Alto Networks**.

**Step 3**

Fill out the form's fields:

* **Name**: a name for the connection
* **Description** (optional): a description of the connection
* **Gateway** (optional): the [Infisical Gateway](/docs/documentation/platform/gateways/overview.md) to connect through, if the device is on a private network
* **Hostname**: the IP address or hostname of the device's management interface, such as `firewall.example.com`
* **Username**: the username of the administrator from [Step 1](#step-1-create-a-dedicated-pan-os-administrator)
* **Password**: the password of that administrator
* **Port** (optional): the HTTPS port of the management interface (defaults to `443`)

**Step 4**

On the **SSL** tab, set how the connection verifies the TLS certificate of the management interface. PAN-OS uses a self-signed certificate for the management interface by default, so do one of the following:

* Paste the certificate of the CA that issued the management interface certificate, in PEM format, into **SSL Certificate**
* Turn off **Reject Unauthorized** to skip verification

**Step 5**

Select **Connect to Palo Alto Networks**.

> [!TIP]
>
> Your Palo Alto Networks app connection is ready to use.

## Step 3: Configure integrations

Now that your Palo Alto Networks app connection is configured, you can use it to set up the following integrations:

> **[Palo Alto Networks](/docs/documentation/platform/pki/applications/certificate-syncs/palo-alto-networks.md)**
>
> Deploy certificates to PAN-OS firewalls and Panorama templates.

> **[Palo Alto Networks SSL/TLS profile](/docs/documentation/platform/pki/applications/certificate-syncs/palo-alto-networks-ssl-tls-profile.md)**
>
> Point a PAN-OS SSL/TLS service profile at a synced certificate.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.