Requirements

• A Palo Alto Prisma Access instance with Strata Logging Service integrated.
  
  • Refer to Introduction to Strata Logging Service for further reference.
    
• Have admin access to the Strata Logging Service.
• The most recent version of the Lumu Virtual Appliance installed.

Deploy and Set Up Lumu VA

All the detailed steps and guidance to create, download and install a virtual appliance on your preferred hypervisor or Cloud solution are available in our documentation:

• Deploy Virtual Appliances
  
• Configure Virtual Appliances and set up collectors.
  

Create a self-signed certificate to support SyslogTLS communication with the Virtual Appliance

• Create a Certificate Authority (CA)
• Create a digital certificate and its key for your Virtual Appliance

If your organization uses an existing internal Certificate Authority (CA) ask your CA administrator to issue a certificate for your Virtual Appliance with the required extensions to support OCSP validation. If you want to use a third-party certificate, ensure it includes the OCSP responder section and it is issued to the Virtual Appliance.

Preliminary setup

Before you start to follow the steps depicted in the following sections, you must install the OpenSSL package. According to your Linux OS flavor, use your distribution package manager to install it. For this guide, we will assume an Ubuntu OS. Run the following command to install openssl:

sudo apt upgrade
sudo apt install openssl -y

Follow the on-screen instructions, if prompted, and complete the installation.

After installing OpenSSL, create a work directory for all the artifacts that will be used during this configuration by running this command:

mkdir /opt/ca/

Locate yourself into the created working directory, then create a configuration file for OpenSSL Use the following template to create the openssl.cnf file and modify it based on the proposed guidelines.

# OpenSSL root CA configuration file.
[ ca ]
default_ca = CA_default

[ CA_default ]
# Directory and file locations.
dir               = /etc/pki/ca
certs             = $dir/certs
crl_dir           = $dir/crl
new_certs_dir     = $dir/newcerts
database          = $dir/index.txt
serial            = $dir/serial
RANDFILE          = $dir/private/.rand

# The root key and root certificate.
private_key       = $dir/certs/ca.key
certificate       = $dir/certs/ca.pem

# For certificate revocation lists.
crlnumber         = $dir/crlnumber
crl               = $dir/crl/ca.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30
default_md        = sha256
name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
preserve          = no
policy            = policy_strict

[ policy_strict ]
# The root CA should only sign intermediate certificates that match.
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
# Allow the intermediate CA to sign a more diverse range of certificates.
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
default_bits        = 2048
distinguished_name  = req_distinguished_name
string_mask         = utf8only

# SHA-1 is deprecated, so use SHA-2 instead.
default_md          = sha256

# Extension to add when the -x509 option is used.
x509_extensions     = v3_ca

[ req_distinguished_name ]
commonName                      = Common Name
countryName                     = Country Name (2 letter code)
stateOrProvinceName             = State or Province Name
localityName                    = Locality Name
0.organizationName              = Organization Name
organizationalUnitName          = Organizational Unit Name
emailAddress                    = Email Address

# Optionally, specify some defaults.
countryName_default             = XX
stateOrProvinceName_default     = MyState
localityName_default            =
0.organizationName_default      = MyOrg
organizationalUnitName_default  =
emailAddress_default            =

[ v3_ca ]
# Extensions for a typical CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
# Extensions for a typical intermediate CA (`man x509v3_config`).
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
# Extensions for client certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ server_cert ]
# Extensions for server certificates (`man x509v3_config`).
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS = VA_IP
authorityInfoAccess = OCSP;URI:http://OCSP_SERVER:OCSP_PORT

[ crl_ext ]
authorityKeyIdentifier=keyid:always

[ ocsp ]
basicConstraints = CA:FALSE
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, digitalSignature
extendedKeyUsage = critical, OCSPSigning

Replace:

OCSP_SERVER by the IP address or the FQDN of your OCSP responder server

OCSP_PORT by the port of your OCSP responder service

VA_IP by the Virtual Appliance public IP address

Ensure your OCSP responder server allows connections to the selected port.

Now, you are ready to follow the next configuration sections.

Create a Certificate Authority (CA)

1. Enter and confirm a PEM pass phrase when requested. Save it for further usage.
2. Enter a distinctive Common Name, like My Internal CA.
3. Enter your Country Name (2 letter code).
4. Enter your State or Province Name.
5. Enter your Locality Name or city. You can leave this field blank.
6. Enter your Organization Name.
7. Enter your Organizational Unit Name. You can leave this field blank.
8. Enter your Email Address. You can leave this field blank.

• ca.key is your new Certificate Authority private key.
• ca.pem is your new Certificate Authority public key.

Create your Virtual Appliance certificate

1. Enter a distinctive Common Name. This name must match the VA IP address.
2. Enter your Country Name (2 letter code).
3. Enter your State or Province Name.
4. Enter your Locality Name or city. You can leave this field blank.
5. Enter your Organization Name. Ensure this is the same as the organization name defined when creating your Certificate Authority.
6. Enter your Organizational Unit Name. You can leave this field blank.
7. Enter your Email Address. You can leave this field blank.

• va.key is your Virtual Appliance private key.
• va.csr is your Virtual Appliance certificate signing request. Your internal CA must sign this

All va files (va.csr, va.pem, and va.key) must be stored safely. These files will be needed later to set up the Virtual Appliance and the Strata Logging Service.

Create an OCSP responder service

• Create the OCSP responder service certificate
• Run OpenSSL as an OCSP responder service

Create the OCSP responder service certificate

1. Enter a distinctive Common Name. You can use something like OCSP Responder.
2. Enter your Country Name (2 letter code).
3. Enter your State or Province Name.
4. Enter your Locality Name or city. You can leave this field blank.
5. Enter your Organization Name. Make sure this is the same as the organization name defined when you created your Certificate Authority.
6. Enter your Organizational Unit Name. You can leave this field blank.
7. Enter your Email Address. You can leave this field blank.

• ocsp.key is your OCSP responder service private key.
• ocsp.csr is your OCSP responder service certificate signing request. This must be signed by your internal CA.

Run the OCSP responder service

Now you are ready to run your OCSP responder service. Create the following script file into the server you used to sign the OCSP responder Certificate Signing Request, your internal CA.

#!/bin/bash
# Responder daemon
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
cd "${SCRIPT_DIR}"
# Check if the process exists
if [[ -f "pid.pid" ]]; then
    PID=$(cat "pid.pid")
    if [ -z "$PID" ] || [ -d /proc/$PID ] ; then
        echo "[!] Process is already running. Exiting"
        exit 1
    fi
fi
sudo nohup openssl ocsp -index /etc/pki/ca/index.txt -port OCSP_PORT -rsigner /etc/pki/ca/ocsp/ocsp.pem -rkey /etc/pki/ca/ocsp/ocsp.key -CA /etc/pki/ca/certs/ca.pem -text -out /tmp/ocsp.log > /dev/null 2>& 1 &
pid=$!
# Store the PID to avoid duplication
echo $pid > "pid.pid"

Set up a Lumu VA Firewall Log Collector

• Protocol type: Select the TCP option. Strata Logging Service uses TCP protocol to send Syslog data.
• Port number: Provide a number between 1024 and 65535, inclusive.

To implement the TLS communication between the Strata Logging Service and the Virtual Appliance, you must:

• Prepare your Virtual Appliance
  
• Copy the certificates into your Virtual Appliance
• Modify your Virtual Appliance configuration to use the certificates
  

Prepare your Virtual Appliance

The version string is at the end of the line Welcome to LUMU Virtual Appliance…

     - "./log_collector_certs/:/opt/logstash/certs/"

Remember to keep the spaces at the beginning of the line. If you miss the spaces when adding the configuration line, the VA will not start.

Your volumes section must look as follows:

Copy your certificates to your Virtual Appliance

Copy your va files (va.pem and va.key) and your CA public certificate (ca.pem) created on the Create a Certificate Authority (CA) and Create your Virtual Appliance certificate sections to the folder created on Step 3 of Prepare your Virtual Appliance. You can use the secure copy client of your preference.

Modify your Virtual Appliance configuration to use the certificates

Now, you must modify your Palo Alto Prisma Access collector configuration file input to implement the TLS reception with the copied certificates. Edit the file indicated at the end ot the step Set up a Lumu VA Firewall Log Collector. The collector configuration files are located in the following folder:

input {
    tcp {
        port => 1540
        mode => "server"
        type => "syslog"
        ssl_enabled => true
        ssl_certificate_authorities => "/etc/logstash/certs/ca.pem"
        ssl_certificate => "/etc/logstash/certs/va.pem"
        ssl_key => "/etc/logstash/certs/va.key"
        ssl_client_authentication => "none"
    }
}

Save your configuration file and start your appliance.

Configure Strata Logging Service to Send Metadata to Lumu VA

1. Sign in to the application hub and select the Strata Logging Service,.

2. In the Strata Logging Service window, head to the left navigation pane and click on the Log Forwarding menu.

If you are using Strata Cloud Manager to manage Strata Logging Service, click on Settings > Strata > Logging Service > Log Forwarding.

3. In the Log Forwarding window, click on the Plus (+) icon to add a new Syslog forwarding profile.

4. Fill in the data into the New Syslog profile window. Follow these guidelines.

a. Enter a distinctive Name(1) for the profile.

b. Enter your Virtual Appliance public IPv4 address in Syslog Server(2). Ensure that the value here matches the Subject Alternative Name (SAN) of the certificate installed on your Virtual Appliance

c. Enter the Port(3) you configured in your Virtual Appliance.

d. Select the Facility(4) to match LOG_USER.

e. In the Server Authentication(5) section upload your CA certificate if you used a self-signed certificate. If you are using a third-party certificate you can skip this.

f. Click on the Test Connection(6) button to ensure Strata Loggins Service can communicate with your VA. Any issues must be resolved to proceed with the rest of the configuration.

g. After validating the Syslog connection, click on the Next(7) button.

5. In the following screen, fill in the data based on these guidelines:

a. In the FORMAT(1) field, select the CSV option.

b. Leave the DELIMITER(2) value in COMMA: “,”.

c. Click the Add(3) button under the FILTERS section and add the following filters:

Log source	Log type	Filter
Firewall logs	url	All logs
Firewall logs	threat	All logs
Firewall logs	traffic	All logs

d. When finished, save your changes by clicking on the Save button.