Certificate Setup on HA Pair

RyanJohnstone — Fri, 14 Dec 2018 11:48:40 GMT

Hello,

I wanted to use the SSL/TLS profile facility to restrcit management GUI sessions to TLSv1.2 but am having trouble with the certificates/process to follow. We have an Active/Passive HA Pair, i have been trying to setup on the passive to test but it is not working, from having a look around i susepct this may need to be setup on the Active with just the profile selection defined on the passive.

Can anyone guide please on the correct process and what certificates / profles need to be created where, e.g. do i create the Self Signed Root CA on the Active firewall, generate the certiciates (signed by created root) to be used for both primary and active SSL/TLS profiles on the Active Firewall and then create both SSL/TLS profiles on the Active Firewall. Then on Actve and Passive Firewalls just select the correct SSL/TLS profile?

Appreciate any guidance.

Thanks

Ryan

Re: Certificate Setup on HA Pair

reaper — Wed, 19 Dec 2018 14:27:12 GMT

Here's the specifics on what does not get synced in HA:

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/high-availability/reference-ha-synchronization/what-settings-dont-sync-in-activepassive-ha

it specifically mentions:

The configuration for the associated SSL/TLS Service profile (Device > Certificate
 Management > SSL/TLS Service Profile and the associated certificates (Device > 
Certificate Management > Certificates) is synchronized. It is just the setting of 
which SSL/TLS Service Profile to use on the Management interface that does not sync.

topic Certificate Setup on HA Pair in General Topics

Certificate Setup on HA Pair

Re: Certificate Setup on HA Pair