topic Re: Panorama cluster web certificate in General Topics

Panorama cluster web certificate

radp — Thu, 02 Oct 2014 07:40:27 GMT

panorama cluster web certificate | Palo Alto Networks Live

Hello All, I wanna use our PKI and created certificate for primary Panorama to not get WEB cert. error but I`m not able to do so on standby as it saing:

"Configuration changes not allowed on the passive Panorama"

Is there any step I`m missing or its not possible to do so?

THX for any replau

Shared with Jive Anywhere

https://live.paloaltonetworks.com/search.jspa?q=panorama+cluster+web+certificate

Re: Panorama cluster web certificate

bat — Thu, 02 Oct 2014 07:58:08 GMT

Hi radp

Did you do a commit on active panorama after generating the certificate ?

You should be able to see the certificate on standby panorama after the commit.

Thanks

Re: Panorama cluster web certificate

radp — Thu, 02 Oct 2014 08:01:18 GMT

Yes I see cert from active panorama but its no for stand by as CN is just for active one.

Do I need to have both CNs in this certificate, as it would be different behavior then on FWs where I has to create separate certificates (web certificates are not sunced to peer)

Radek

Re: Panorama cluster web certificate

bat — Thu, 02 Oct 2014 08:12:39 GMT

radp

Try creating a new certificate on primary Panorama itself to be used as a web certificate on standby.

Do a commit on active and then mark it as a web cert on standby panorama

Now do a commit on passive.

Let me know if that helps.

Thanks

Re: Panorama cluster web certificate

radp — Thu, 02 Oct 2014 08:16:22 GMT

This could make sense. Thanks for suggestion. This will take same time as certificate has to bi signed be external CA / different departmen

Radek

Re: Panorama cluster web certificate

radp — Thu, 02 Oct 2014 14:49:22 GMT

Thank you all is working as you suggested!