Issue on updating cert on Palo Alto FW pair

Jatin.Singh — Mon, 26 Aug 2019 06:45:18 GMT

I got an issue to update a cert on PA pair.

The issue is very similar to what it describes under

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CldECAS

I import the new cert to both PA FW units and change config to use the new cert. However it comes with config out-of-sync issue and somehow the new cert on passive unit is removed after committing config.

any fix for the issue?

Re: Issue on updating cert on Palo Alto FW pair

S.Cantwell — Mon, 26 Aug 2019 20:20:26 GMT

This is what I would do (thinking out of the box)

If HA firewalls....

Export the configurtion from the active FW.

Import the configuration in the passive FW

Now, both FWs have 100% the exact config.

On the passive FW, change the config to modify/update the config to use the original mgmt IP

On the passive FW, because it has the exact HA configuration as the active FW, modify it so that is has the orignal HA settings that the standby FW would have.

Commit on the standby

Now, you have the cert on both FWs

topic Issue on updating cert on Palo Alto FW pair in General Topics

Issue on updating cert on Palo Alto FW pair

Re: Issue on updating cert on Palo Alto FW pair