Enroll Korthveil firewalls

Firewalls

A per-tenant inventory of client firewalls with live health — management-plane reachability and latency, and, when linked to an SNMP target, model, uptime, interface up/down counts and CPU. SentinelOps keeps it so a firewall that silently dies is caught before the client reports an outage. This is monitoring, not rule management; adding a firewall requires the credential.manage permission.

Reachability and latency: Each card shows an UP / DOWN / “not polled” pill and the management-plane latency in milliseconds, with when it was last polled — a quick health signal from the management interface answering, even without SNMP.
SNMP health: Link an SNMP target and the card fills in model, uptime, interfaces up/down and CPU percent. Without a linked target those tiles read “—” and the card notes that model/uptime/interface/CPU health needs an SNMP target.
Poll, scope and remove: Poll re-checks a firewall on demand rather than waiting for the automatic cycle. This view is monitoring only — deep, per-vendor rule management shows “integration required” and isn’t wired in. Remove takes the firewall out of SentinelOps but changes nothing on the device.

Firewall Certificates

Puts the trust a Korthveil firewall needs onto the machines behind it. TLS inspection only decrypts traffic from devices that trust the firewall’s inspection CA; NAC (802.1X Enterprise Wi-Fi) only admits devices that trust the NAC CA and hold their own certificate from the firewall. One profile per CA, deployed to Windows, macOS and Linux with or without the agent.

Certificate profiles: Add certificate profile: paste or pick the CA file Korthveil gives you (Security › TLS inspection › Download CA certificate, or the download icon on the nac-ca row in System › Certificates). Only the public certificate is stored; anything with a private key is refused. Compare the SHA-256 shown with the one on Korthveil’s install page. “Install on every new machine” adds the CA to each machine that enrolls later. A NAC profile also needs the Wi-Fi name and the RADIUS server name from the nac-radius certificate.
Machines with the agent: Install, Check or Remove on every machine, an organization, a group, or ticked machines. Windows: Trusted Root (machine) and Firefox enterprise roots. macOS: the System keychain; when macOS insists on local approval, the user gets a profile to approve and the result says “Waiting for the user”. Linux: the distro trust store, Chrome/Chromium NSS databases and a Firefox policy; missing tools are installed automatically.
NAC device certificates: Pick every device’s .p12 at once. Files are matched to machines by name (laptop-1.p12 → laptop-1), and you enter each one-time password. Each file and password goes only to that machine’s agent as a sealed secret over stdin; neither is stored, logged or shown again. The agent installs the certificate, the CA and the Enterprise Wi-Fi profile (Windows machine authentication, Linux NetworkManager, macOS profile the user approves). Needs agent 0.5.38 or newer.
Issue device certificates from the firewall: Easiest for NAC (Korthveil 1.1.53+). Edit a NAC profile and choose the firewall and its CA name (usually nac-ca). On the firewall, give SentinelOps commit authority (System › SentinelOps RMM) and allow that CA under system.certificates.remoteIssue. Then “Issue device certificates from the firewall” gives each chosen machine its own certificate (named sops-<machine ID>, common name = the machine’s DNS name). The key travels only as a sealed secret to that machine’s agent, which installs it with the CA and the Wi-Fi profile. Running it again renews. “Revoke device certificates”, or removing the machine from SentinelOps, revokes it on the firewall and NAC refuses the machine at once. “Give every new machine its own certificate” does this on enrollment.
Windows domain (Group Policy): For domain PCs without the agent: the agent on a domain controller creates the “Korthveil certificate - <profile>” Group Policy at the domain root. Its startup script adds the CA, so PCs trust it after their next restart. “Remove from domain PCs” turns the script into a removal; delete the Group Policy afterwards.
Machines without an agent (SSH / WinRM): An online agent on the same network logs in with a stored credential (Agent Deployment › Credentials) and runs the same install, check or removal. One line per machine: address and os (windows, linux or macos). Only private addresses. NAC device keys are never sent this way.
Results: One row per machine, updated every 5 seconds: Installed, Waiting for the user, Not installed, Removed, Queued or Failed, with what the machine reported.

Next: Reach any machine →