topic Re: Scheduled backup export in Panorama Discussions

Scheduled backup export

Netzer — Thu, 21 Jul 2022 05:19:17 GMT

Hi there,

I have a scheduled backup job running every night, which exports my Panorama config to a backup server, it is running for over a year now without any problem.

Yesterday I went over the config, changed the time and permitted the config.

This morning I saw that the backup failed due to missing ECDSA SSH key.

Failed exporting config bundle via ssh to 1x.xx.xx.xx. No ECDSA host key is known for 1x.xx.xx.xx ...Host key verification failed...lost connection

The test connection button on the backup schedule page asks if I want to add the key, system says it added the key but it seems to do nothing. Same message when I press the button again, same error message when the backup job runs again.

Im on Panorama version 10.2.2

Has anyone a hint how to fix or work around that issue?

Re: Scheduled backup export

ahandoo — Thu, 21 Jul 2022 07:37:18 GMT

Hi @Netzer

You can follow this Knowledgebase Article which can be of help.

Regards,

Arnesh

Re: Scheduled backup export

Netzer — Thu, 21 Jul 2022 08:16:32 GMT

I tried it two times but still the same error. SCP from CLI works, but the scheduled task still doesn't and is throughing the same error.

Re: Scheduled backup export

Netzer — Fri, 22 Jul 2022 09:07:04 GMT

Is anyone using FTP for config export? I installed vsftpd on SLES, a standard ftp client can connect normally, the export job in Panorama cannot login - Login incorrect.

What a **bleep** mess....

Re: Scheduled backup export

CKobelsky — Fri, 22 Jul 2022 16:05:43 GMT

I'm setting up a new Panorama system (version 10.2.2-h1) and I'm having the same issue. Can't get schedule config export working at all (either using FTP or SCP).

Re: Scheduled backup export

Netzer — Mon, 25 Jul 2022 06:21:02 GMT

Did you try the suggestion from ahandoo? I had no luck with it.

Did the update to 10.2.2-h1 during weekend but still the same situation, seems to be a bug. Is there any way to report this issue officially to Palo Alto Networks?

Is it possible to create the scheduled backup via CLI?

Re: Scheduled backup export

CKobelsky — Mon, 25 Jul 2022 20:44:55 GMT

Yes I tried that, no dice. It seems like it isn't storing the host key at all. I'm not sure if you can make a scheduled backup from the CLI, but considering what I'm seeing I don't think that will help.

Re: Scheduled backup export

ahandoo — Tue, 26 Jul 2022 08:45:39 GMT

Hi @Netzer , @CKobelsky

Ideally, the device should update the ssh key in the known-hosts file after following the article. It is interesting to know that the CLI test work fine but the schedule for config export.

As it does not work, then the TAC may access the known-hosts file to check if there are any issue or if this is any Bug.

Have you tried reaching out to the TAC regarding this?

Regards,

Re: Scheduled backup export

Netzer — Tue, 26 Jul 2022 11:13:55 GMT

The article commands react like this.

Looks good but it doesn't fix the problem with the scp export.

Re: Scheduled backup export

Netzer — Tue, 26 Jul 2022 12:22:16 GMT

The only option what works for me is anonymous ftp.

Re: Scheduled backup export

CKobelsky — Tue, 26 Jul 2022 15:13:44 GMT

I do have a low priority ticket open with support. They got back to me wanting a detailed discussion, but haven't scheduled that yet

Re: Scheduled backup export

Netzer — Wed, 27 Jul 2022 05:01:00 GMT

Same here, we checked the issue yesterday with our PA support partner and opened a case at PA. Hopefully it doesn't take that long to fix as the ACC IP issue...

In the meantime I'm using anonymous ftp together with a copy script which moves the backup file away, shi**y solution I know but better than nothing.

Keep you up2date

Re: Scheduled backup export

PaulMarroquin — Mon, 01 Aug 2022 15:57:18 GMT

@Netzer Is there any way for you to DM me the PAN-TAC case# ? I'm having the same issue and would like to reference it when I open a ticket with them

Re: Scheduled backup export

Netzer — Tue, 02 Aug 2022 04:03:13 GMT

I have a TAC remote session today in the afternoon, I will let you know the result here. At the moment I have only the case number from my palo alto support partner but this is not the real PA case number. If they have no short workaround today and we have to way for a fix then I'll ask my partner to send me the PA case number and then I can give it to you.

Re: Scheduled backup export

CKobelsky — Tue, 02 Aug 2022 15:14:36 GMT

I had a discussion with support last week which didn't accomplish anything (just made me run a few commands that I already messaged them about). They have the tech support bundle from my Panorama instance so we will see if they can find anything.

Re: Scheduled backup export

Netzer — Wed, 03 Aug 2022 03:44:47 GMT

We could fix the problem temporarily yesterday during our support session. The TAC guy logged in via root to Panorama. Then a simple ssh [user]@[backup-server-ip] was all whats needed. SSH key got saved and the web gui scheduled export function was working again.

They gonna check the issue and hopefully it will be fixed soon.

Re: Scheduled backup export

Netzer — Wed, 03 Aug 2022 07:56:43 GMT

Just got the info from my support partner, that the issue has been analyzed by PA and will be fixed in Version 10.2.3, release date is planed for next month.

Re: Scheduled backup export

CKobelsky — Wed, 10 Aug 2022 20:00:09 GMT

@PaulMarroquin my system is not in FIPS mode. I did get "confirmation" from the Palo Alto tech as well that it is a glitch and it will be fixed in the next version (whether it was actually confirmation or just took this thread at it's word I'm not sure)

Re: Scheduled backup export

Pablo-Molina — Fri, 30 Sep 2022 07:20:06 GMT

Hi all,

Today I upgraded to 10.2.3 version and problem with Scheduled Config Export via SCP still appears. Somebody upgraded to 10.2.3 and also obtain the same results?

Re: Scheduled backup export

CKobelsky — Tue, 04 Oct 2022 22:06:29 GMT

@Pablo-Molina @Netzer @PaulMarroquin @ahandoo I just upgraded to 10.2.3 on Panorama and this issue is still there. The release notes didn't seem to mention this problem either.