topic Web Auth FW with HA in General Topics

Web Auth FW with HA

Alpalo — Wed, 20 Sep 2023 14:36:25 GMT

Hello,

I am configuring Webauth with certificate on my FW cluster and currently the access to the active FW is correct.

I have created CA and client certificate correctly, the problem I am facing to access the passive node,

is it necessary to create another CA also for the Passive FW?

Is there any way to have a single CA for the cluster?

Can anybody helps me?

Greetings.

Re: Web Auth FW with HA

PavelK — Wed, 20 Sep 2023 22:01:50 GMT

Hello @Alpalo

thanks for post!

You will have to import the certificate to passive Firewall and then create SSL/TLS profile. These configurations are not synchronized between Active / Passive Firewalls: what-settings-dont-sync-in-activepassive-ha:

Kind Regards

Pavel

Re: Web Auth FW with HA

Alpalo — Fri, 29 Sep 2023 06:48:14 GMT

Hi team,

@PavelK i tried with your recommendation but problem still continues, I followed the procedure : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcCCAS adn Web auth with certificate works fine with Active node, but I cannot access to the passive node 😞 Any idea?

Regards

Re: Web Auth FW with HA

PavelK — Fri, 29 Sep 2023 13:04:40 GMT

Hello @Alpalo

thank you for reply.

Could you confirm that passive Firewall has all required certificate / certificate chain used in certificate profile?

Could you check what authentication logs say in passive Firewall when authentication fails: tail follow yes mp-log authd.log?

Kind Regards

Pavel