Palo Alto (managed by Strata) Integration

List view

Integrations

Applications

Supported Applications

App-specific Handling

Cursor[old]

Claude[old]

Configuring ChatGPT Desktop App for macOS

Configuring AWS CLI for macOS

Configuring Claude Code CLI

Configuring Cursor

ChatGPT macOS Native App[old]

AWS CLI[old]

test

Hello

Palo Alto (managed by Strata) Integration

Configuring your Palo Alto VPN to work with Lumia is simple. Follow the steps below, and feel free to contact us at support@lumia.security if you have any questions.

Prerequisites:

Palo Alto VPN is managed by Strata Cloud Manager (if you are using Panorama instead, see here).
You have shared your gateway IP addresses with Lumia. This allows us to restrict access to your tenant to traffic coming only from your organization.
GlobalProtect is deployed and enforced on all endpoints subject to Lumia governance.
SSL Inspection is already configured (active inspection is not required; the certificate infrastructure only needs to be in place).
Palo Alto must not be configured with Proxy Auto-Configuration (PAC) files.

If one of the above prerequisites are not met, please contact us before proceeding.

[UNDER CONSTRUCTION]

Step 1: Sign Lumia’s CA with your Palo Alto CA

Prerequisites: For this step, you should have received the lumia.csr (Certificate Signing Request) and lumia.ext files from Lumia. If you did not receive them, please contact us at support@lumia.security.

In this step, you will sign Lumia’s CA certificate using your Palo Alto Forward Trust CA. This is required so that Lumia can intercept traffic (man-in-the-middle).

Export your Palo Alto Forward Trust CA certificate, including its private key, so you can use it to sign Lumia’s CA.
Never share this file with anyone (including Lumia), and delete it immediately after completing this step.
To export the certificate:

Go to DEVICE → Certificate Management → Certificates
Identify the certificate marked with Forward Trust Certificate in the USAGE column
Click Export Certificate

Check Export Private Key, choose a passphrase for the exported file, click OK. The file will be downloaded to your Downloads folder with a name such as palo.pem. Never share the exported PEM file or its passphrase with anyone.

Open a terminal or command prompt.
Place lumia.csr, lumia.ext, and palo.pem in the same directory, and run:


openssl x509 -req -in lumia.csr -CA palo.pem -CAkey palo.pem -out lumia.crt -days 1825 -sha256 -extfile lumia.ext

After the certificate is generated, send the resulting lumia.crt file to Lumia at support@lumia.security.

Step 2: Enable SSL inspection for Lumia’s proxy

Prerequisites: For this step, you should have received your Lumia Proxy FQDN from Lumia (it will look similar to 85fca78ac7e8132c2fbcf0ed95ee3dc.proxy.us.lumiasecurity.com). If you do not have this, please contact Lumia at support@lumia.security.

In this step, you will instruct your Palo Alto to encrypt traffic to Lumia’s proxy. This will ensure the traffic is both secured and identifiable.

Go to POLICIES → Decryption → Pre Rules, then click Add.

In the General tab:

Set Name to decrypt-lumia-proxy.

In the Source tab:

Select Any for SOURCE ZONE.

In the Destination tab:

Select Any for DESTINATION ZONE.
Click Add under DESTINATION ADDRESS.
Click New Address.

In the Address window:

Set Name to Lumia Proxy.
Set Type to FQDN.
Set FQDN to your Lumia Proxy FQDN.
Click OK.

In the Options tab:

Set Action to Decrypt.

Click OK to create the decryption rule.

Step 3: Configure a Header Insertion Profile for Lumia’s proxy

In this step, you will create a Header Insertion Profile for your Palo Alto to send encrypted user identification together with the traffic it forwards to Lumia.

Go to OBJECTS → Security Profiles → URL Filtering, then click Add.

Set Name to Add X-Authenticated-User.
Select the HTTP Header Insertion, then click Add.

In the HTTP Header Insertion window:

Set Type to Custom.
Set Name to X-Authenticated-User (skip this block if already exists.)
Click Add Domains.
Set * to catch all domains.
Click Add Headers.

In the Headers window:

Set Header to X-Authenticated-User
Set Value to ($user)@($domain)

Click OK three times to create the URL Filtering Rule.

Step 4: Assign the Header Insertion Profile to the Security Policy

In this step, you will configure your Palo Alto to use the Header Insertion Profile when forwarding traffic to the Lumia proxy.

Go to POLICIES → Security → Pre Rules, then click Add.

In the General tab:

Set Name to Allow access to Lumia Proxy.

In the Source tab:

For SOURCE ZONE, select the zone used by your VPN users. If your are not sure, it is ok also acceptable to select Any.

In the Destination tab:

Set DESTINATION ZONE to Any.
Set DESTINATION ADDRESS to the Lumia Proxy Address object you created in Step 2.

In the Actions tab:

Set Action to Allow.
Set Profiles Type to Profiles.
Set URL Filtering to the Add X-Authenticated-User profile you created in Step 3.

Click OK to create the security policy rule.
Security rules are evaluated from top to bottom, so ensure the newly added rule is matched before any broader rules. If you are unsure, and because the rule is very specific, you can move it to the top of the list by clicking Move Top.

Step 5: Push Lumia’s PAC settings via GlobalProtect

Prerequisites: For this step, you should have received your Lumia PAC URL from Lumia (it will look similar to

https://pac.us.lumiasecurity.com/p/EXPDG3ZHNKSU3QU7F3NGKBZA5JGPIIOB364K3KFSW562XQMNUUFQ27GXRYFIV3TOOBSLEQMUOKBXVWK6LDQ5R47THCLRAPSD5T6S2TFCVEYWKHNJBRDGV6X3KLJTDO23CQN5L5OTM/proxy.pac

). If you do not have this, please contact Lumia at support@lumia.security.

In this step, you will configure GlobalProtect users to use Lumia’s PAC URL.

Go to NETWORK → GlobalProtect → Portal, then click the relevant GlobalProtect profile.

Click the Agent tab, then click the relevant Agent Config profile.

In the Configs window:

Select the App tab.
In the App Configuration pane, look for Proxy Auto-Configuration (PAC) File URL, then set it to the Lumia PAC URL.

Click OK two times to update the GlobalProtect to push Lumia’s PAC.

Step 6: Commit and test

Once everything is configured, commit and push the changes you’ve made.

You can use https://check.lumiasecurity.com to make sure everything is working.

Palo Alto (managed by Strata) Integration Prerequisites:[UNDER CONSTRUCTION]Step 1: Sign Lumia’s CA with your Palo Alto CA Step 2: Enable SSL inspection for Lumia’s proxy Step 3: Configure a Header Insertion Profile for Lumia’s proxy Step 4: Assign the Header Insertion Profile to the Security Policy Step 5: Push Lumia’s PAC settings via GlobalProtect Step 6: Commit and test