topic Re: Panorama Distributed Certs in General Topics

Panorama Distributed Certs

apackard — Fri, 30 Mar 2012 18:34:53 GMT

Am I going mad, or can anyone else not actually use certificates imported in Panorama and then distributed to end devices?

Once I have pushed these to PA's I cannot seem to apply them to 'functions' via the GUI or the CLI.

Using the same certificate uploaded directly to the PA, everything is fine.

I'm on PAN-OS 4.1.4.

Rgds

Re: Panorama Distributed Certs

mschuricht — Fri, 30 Mar 2012 19:44:04 GMT

The Panorama pushed certs can be used but you must us the CLI for configuring as a forward un/trust cert.

admin@PA-2020# set vsys vsys2 ssl-decrypt

+ forward-trust-certificate CA certificate for trusted sites

+ forward-untrust-certificate CA certificate for untrusted sites

Is this where you were trying to use the cert?

Re: Panorama Distributed Certs

mikand — Fri, 30 Mar 2012 19:53:36 GMT

How come this cannot be done through Panorama?

Re: Panorama Distributed Certs

mschuricht — Fri, 30 Mar 2012 20:38:13 GMT

The UI shows settings from two different places in the config in one location. A certificate is something that lives under a portion of the config which can be pushed from Panorama and the ssl decrypt settings lives in a place which currently does not support central management.

We are investigating the effort to support pushing these settings in a future release of Panorama.