topic Panorama reset Authentication Profile (Certificate Profile based Authentication) via CLI in General Topics

Panorama reset Authentication Profile (Certificate Profile based Authentication) via CLI

CarloTaddei — Fri, 16 Aug 2019 19:25:39 GMT

Hi,

I have configured (on a test Panorama VM - luckly not on the production one) a SSL Certificate Based authentication following the steps provided on the Panorama Administrator's Guide; somehow It didn't quite worked out and I'm currently locked out.

I do have admin access to the Panorama VM via CLI -> is there any chance to reset the GUI authentication profile to username and password (its default) ? thanks

Re: Panorama reset Authentication Profile (Certificate Profile based Authentication) via CLI

TSilverline — Sun, 18 Aug 2019 02:16:03 GMT

If you have access to CLI, create a new authentication-profile using the set authentication-profile command.

Then, assign the authentication profile to the user you want to login with using set mgt-config users *username* authenticaton-profile command

Re: Panorama reset Authentication Profile (Certificate Profile based Authentication) via CLI

CarloTaddei — Tue, 20 Aug 2019 11:06:27 GMT

Hi,

thank you for the feedback but this is not really what I'm after.

I would like to enable

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/firewall-administration/manage-firewall-administrators/configure-administrative-accounts-and-authentication/configure-certificate-based-administrator-authentication-to-the-web-interface.html

However at the very beginning of the Web Page I can read:

"Configuring certificate-based authentication for any administrator disables the username/password logins for all administrators on the firewall; administrators thereafter require the certificate to log in."

I would like to know if there is any possibility to reset the "Certificate-Based Administrator Authentication to the Web Interface" via cli should something go wrong ...

Is this technically possible / supported ?

Thank you fro your feedback.

Re: Panorama reset Authentication Profile (Certificate Profile based Authentication) via CLI

TSilverline — Wed, 21 Aug 2019 17:45:31 GMT

Have you tried just deleting the certificate-profile you created with "delete panorama certificate-profile" command?