topic HA state on PA-450 devices "unknown" after masterkey change in General Topics

HA state on PA-450 devices "unknown" after masterkey change

SivaShankarReddy — Wed, 28 Sep 2022 04:37:52 GMT

Hello all,

I am facing an issue with deploying master key in PA-450 firewalls (HA – active/active), I replaced 2 PA 850’s with two PA 450, also in HA.

After Changing the masterkey was tested on the PA-850s prior to being performed on the PA-450s through panorama.

After the masterkey change in PA 450 the app version, threat version, antivirus version, global protect version and plugin DLP indicators all went orange with the unknown state as pic below:

Tried rebooting the firewall but the state went to unknown soon after.

Seeking your assistance on resolving this issue .

Thanks.

@BPry

@OtakarKlier

@reaper

Re: HA state on PA-450 devices "unknown" after masterkey change

reaper — Wed, 09 Nov 2022 14:37:14 GMT

Are you sure you used the same master key on both devices, with the same attributes and everything?

Is HA1 encryption enabled (if so, try downloading and importing both sides' certificates again)

Re: HA state on PA-450 devices "unknown" after masterkey change

OtakarKlier — Wed, 09 Nov 2022 22:39:16 GMT

Hello,

You should be able to regenerate the HA key's again if you dont have them.

Regards,