topic Re: service certificate push from panorama to managed firewalls eg: vpn in Panorama Discussions

service certificate push from panorama to managed firewalls eg: vpn

zaidshaikh — Wed, 24 Sep 2025 14:08:53 GMT

Hi folks,

We have panorama and few pairs to managed firewalls being managed by panorama,

Under the Templates, created CSR and imported the signed CA and pushed it to specific template firewall(say FW01-active), the managed firewall local configurations displays the new certificate, however, on the FW02-passive one the certificate did not sync.

Do we need to separately push to FW02 template, by creating csr and same procedure? since its the vpn service certificate, it should sync from the active-FW01.

Note: Templates care configured for each firewall separate (eg: FW01-Template ; FW02 Template so on)

Re: service certificate push from panorama to managed firewalls eg: vpn

PavelK — Wed, 24 Sep 2025 21:51:37 GMT

Hello @zaidshaikh

thanks for post.

Based on documentation: What Doesn't Sync in Active/Passive HA? most of the certificates and certificate related configuration does not sync in HA deployment. It specifically does not call out a certificate used for VPN, however personally I believe it is a root cause. I would add the certificate to the Template associated with FW02.

Kind Regards

Pavel

Re: service certificate push from panorama to managed firewalls eg: vpn

zaidshaikh — Sun, 28 Sep 2025 09:55:21 GMT

Hi Pavel,

Thank you for the response.

Presently the panorama is provisioned to managed 4 pairs of firewall, each pair is in A-P. What i found is that for each firewall let say FW01-Active has a individual Template and Template stack similarly for FW02-passive has individual T and TS.

Now with regards to s2s vpn cert based authenticate, i want to know if i generate a csr from each firewall template with similar CN: contoso.abc.com and import it into each firewall Template and Push.

Will the VPN will work after failover is trigerred? when old passive FW02 becomes new active? Assuming that similar CN will suffice for th tunnel to get establish with no issues.

Re: service certificate push from panorama to managed firewalls eg: vpn

zaidshaikh — Tue, 30 Sep 2025 18:53:45 GMT

Hi Pavel,

I was able to get the answer from TAC after testing it in LAB:

Each FW template can have separate csr should be generated with the same Common Name in order for the service certificates to work properly during failover. Hence, the peer auth happens based on CN name which is identical in both FW01 and FW02.