topic Re: Active Passive and Active Active PA and Web Gui Cert in General Topics

Active Passive and Active Active PA and Web Gui Cert

MP18 — Fri, 08 Feb 2019 03:47:27 GMT

I have created CSR and exported that to our Server team as they would generate the cert based off of that.

PA is in active passive mode.

Do webgui cert of Active PA will syn with Passive PA?

Do I need to create separte CSR for the passive PA?

We also have PA in Active Active mode.

Does A/P Webgui Cert process is same as Active Active PA?

Re: Active Passive and Active Active PA and Web Gui Cert

OtakarKlier — Fri, 08 Feb 2019 15:48:58 GMT

Hello,

Yes you will need a new csr and cert as certificates are not shared during a commit or config sync.

Regards,

Re: Active Passive and Active Active PA and Web Gui Cert

Raido_Rattameister — Fri, 08 Feb 2019 16:50:32 GMT

Certificates are shared in HA config and also webgui cert config (Device > Setup > Management > Authentication Settings).

So unless you use wildcard you will still get error when you log into one of them as both webgui's have their own DNS name.

Most likely SAN cert that has DNS name of both webgui's on it will work aswell but I have not tested it.

Re: Active Passive and Active Active PA and Web Gui Cert

MP18 — Fri, 08 Feb 2019 17:20:59 GMT

Can you please explain about this in more

So unless you use wildcard you will still get error when you log into one of them as both webgui's have their own DNS name.

Currently on active PA i used the common name as host name of the PA

Re: Active Passive and Active Active PA and Web Gui Cert

Raido_Rattameister — Fri, 08 Feb 2019 17:26:59 GMT

Well it does not matter that your firewalls are set into HA.

They both still have their own management IP (unless you manage it through network interface).

Let's assume that:

PA1 mgmt IP is 10.0.0.11

PA1 mgmt interface DNS name PA1.corp.local that resolves to 10.0.0.11

PA2 mgmt IP is 10.0.0.12

PA2 mgmt interface DNS name PA2.corp.local that resolves to 10.0.0.12

Then you either need *.corp.local cert or SAN cert that has both PA1.corp.local and PA2.corp.local on it.

Management interface cert config is shared between firewalls.

Re: Active Passive and Active Active PA and Web Gui Cert

MP18 — Fri, 08 Feb 2019 17:34:37 GMT

Yes i am using Web Gui cert for the Management interface of both firewalls.

So what I can do now is use this common name on both firewalls while generating the CSR ?

for example

*.NGFW

Then I do not need to create separate CSR for passive device right?

Re: Active Passive and Active Active PA and Web Gui Cert

Raido_Rattameister — Fri, 08 Feb 2019 18:30:34 GMT

You can't use seperate for passive firewall.

This part of the config is synced it means that same cert is used for both active and passive.

Wildcard is probably best way to go.

Re: Active Passive and Active Active PA and Web Gui Cert

MP18 — Fri, 08 Feb 2019 22:36:40 GMT

Many Thanks Raido will give it a try.