topic Re: Certification expiratio - Redistribution question. in General Topics

Certification expiratio - Redistribution question.

BigPalo — Fri, 15 Dec 2023 12:25:15 GMT

Hi,

We are not using redistribution in our FWs. We just have our PAs connected to a UIAgent. So i understand that we dont need to upgrade FWs, just install app&threats version.

The point here, that PA releases a python script and its marking like redistribution is enabled.

If we run the service command for redistribution its enabled but no agents/clients exists. So my questions are:

-The redistribution service in CLI is enable by default althougn you are not using it?

-To have a FW connected to a UIA to get the mappings, that is called "redistribution" for PA?

We dont have redistribution in a FW in version 10, but if we run this commands. The service is UP but no agent/clients connected. Its normal to have service UP althoug you dont have any redis config? Are we needed to upgrade?

show redistribution service status

show redistribution agent state all

Re: Certification expiratio - Redistribution question.

BPry — Sat, 16 Dec 2023 06:09:55 GMT

@BigPalo,

The redistribution service status should be up regardless of if you have any clients configured, so you're good to go there. As long as you don't have any clients or agents configured with the default certificates you don't need to upgrade to a hotfix release. You'll be able to follow the advisory guidance to simply have at least 8776-8390 or later and you'll be good to go.

I'd still personally highly recommend that you simply upgrade to a hotfix release that includes the new certificates by default. This way you don't even need to think about it and you'll know that you're good to go. Nobody wants to start running into issues come new year's day and have to be troubleshooting an issue, just install whatever hotfix you require on your current code branch.

Re: Certification expiratio - Redistribution question.

BigPalo — Mon, 18 Dec 2023 10:47:39 GMT

Many thanks as always BPRY.

It was weird because PA released a github script and we launched it appearing our FWs as "Redistibution" enabled, but we are not using. I understand that this script check just the service which which leads to misunderstanding.