topic Re: Device Certificate - Where to find OTP? in General Topics

Device Certificate - Where to find OTP?

fhewiufhwefhwe — Sun, 17 May 2020 14:26:08 GMT

Under Device -> Setup -> Management -> Device Certificate, I am unable to fetch the device certificate.

A message box says get your one-time-password from the Customer Support Portal and enter it below. I tried my 2-factor OTP that I use to login to the support portal, but that doesn't work. How do I generate the OTP to get the device certificate?

I get the error: Failed to fetch device certificate.OTP is not valid

Re: Device Certificate - Where to find OTP?

Ferenc — Mon, 18 May 2020 13:29:25 GMT

Same here after Panorama upgrade 9.1.1 -> 9.1.2.

Re: Device Certificate - Where to find OTP?

fhewiufhwefhwe — Mon, 18 May 2020 13:41:40 GMT

Mine occurred after downloading renewed yearly subscriptions, or perhaps just the first time I noticed it. I am on 9.0.8.

Re: Device Certificate - Where to find OTP?

dkordyban — Tue, 19 May 2020 13:04:26 GMT

Running 9.1.2. Anyone know where to get the OTP?

Re: Device Certificate - Where to find OTP?

Ferenc — Tue, 19 May 2020 13:09:28 GMT

Not yet. I have a case running with our support partner about this.

Re: Device Certificate - Where to find OTP?

Neubauer — Fri, 22 May 2020 12:02:02 GMT

There is an option to generate OTPs for registered devices in the Customer Support Portal.

Assets -> Device Certificates

Re: Device Certificate - Where to find OTP?

dkordyban — Fri, 22 May 2020 12:16:55 GMT

Thanks. duh.. I should have seen that.

Re: Device Certificate - Where to find OTP?

Ferenc — Fri, 22 May 2020 12:47:14 GMT

Thanks.

Indeed, should've seen it...

Anyhow, my issue is fixed.

Re: Device Certificate - Where to find OTP?

fhewiufhwefhwe — Fri, 22 May 2020 13:17:07 GMT

Thank you!

Re: Device Certificate - Where to find OTP?

ksalustro — Sat, 30 May 2020 02:34:36 GMT

Thanks, i did this and the new cert is good for 3 months.

Why is this necessary? I've never had the issue before v9.1.2.

Am I going to have to do this every 3 months from now on?

Re: Device Certificate - Where to find OTP?

dgnewell — Wed, 17 Jun 2020 18:33:11 GMT

The option for provide a Device Certificate appears in a new section on the Device > Setup > Management page.

This option is part of an enhancement to the telemetry system and will be documented in the next major release of the software. As of today (2020 June 17), you need to be part of the 9.2 beta program to find this documented in the "New Features Guide". Since the feature does appear in the already released 9.1.2, I want to explain what it is here.

By default, all telemetry data is collected and stored locally on your device for a limited period of time. Going forward, this data can not be shared with Palo Alto Networks unless your organization has a Cortex Data Lake license or a device certificate is configured for your firewall.

So, why suddenly is there a Device Certificate option in PAN-OS 9.1.2? Ans: To support connections back to Palo Alto Networks to transfer telemetry data to the Data Lake.

Is a Device Certificate required? Will the operation of my firewall change if I do not supply one? Ans: The Device Certificate is required only to send telemetry data and if you are not already running Panorama and sending logs to the Cortex Data Lake.

Telemetry options are configured on the Device > Setup > Telemetry page.

Hope this helps!

-dgn.

Re: Device Certificate - Where to find OTP?

Ferenc — Thu, 18 Jun 2020 07:02:37 GMT

Thanks for the headsup.

Re: Device Certificate - Where to find OTP?

FarzanaMustafa — Thu, 02 Jul 2020 22:10:57 GMT

@dgnewell

Thank you the explanation.

Is there any ramifications when we enter OTP into the configuration page (eg, will we have to reboot the FW / will there be any downtime, etc)?

Re: Device Certificate - Where to find OTP?

fhewiufhwefhwe — Thu, 02 Jul 2020 22:13:07 GMT

I didn't have any issues when I updated this.

Re: Device Certificate - Where to find OTP?

dgnewell — Thu, 02 Jul 2020 22:43:40 GMT

After you enter the OTP, the task may take a minute or two to complete. You can/should monitor it in the Task Manager (click Tasks in the bottom right of the web interface). Download and installation of the certificate does not even require a commit. You should see no interruption of services or data flow.

Re: Device Certificate - Where to find OTP?

MinoriTelang — Thu, 03 Sep 2020 07:53:15 GMT

I recently installed the device certificate and it is valid only for 3 months. Do I have to install it in every 3 months?

Re: Device Certificate - Where to find OTP?

fhewiufhwefhwe — Fri, 04 Sep 2020 16:35:31 GMT

Mine last renewed at 4:52am, so I think it is automatic.

Re: Device Certificate - Where to find OTP?

Klaverblad — Thu, 24 Sep 2020 06:41:12 GMT

I still don't completely understand this.

We upgraded to 9.1.4 and now we're required to allow telemetry data to PA?

Or accept a constant high alert in the system logs: no valid device certificate found.

Why not allow customers to opt-in to this kind of functionality or at least explain this in a popup screen like a reminder:

"you need to configure this post-upgrade, etc. or opt-out see: "explanation here and here"

Re: Device Certificate - Where to find OTP?

dgnewell — Thu, 24 Sep 2020 07:41:35 GMT

You are not required to allow telemetry.

You can turn it all off on the Device > Setup > Telemetry page.

Telemetry does provide some significant security benefits to individual organizations, and collectively back to the community as a whole.

One use case: In the escalating arms race of automation on the attacker side of the equation and as we, in turn, continue to work on the practical applications of automation and AI, your telemetry data can, for example, enable us, the vendor, to initiate immediate, focused, and direct outreach in the event of corner-case configurations that are discovered to be uniquely vulnerable and/or actively in the spotlight of bad actors. Without individual and community-wide participation, certain kinds of detections, assessments, and mitigations, of course, become impossible to make. Hand in hand, the ability to process, store, and apply intelligence to such telemetry data requires data-lake-scale solutions, but not at the expense of assurances of the integrity of the connections to that resource and the integrity and context of the data itself. Thus, the additional requirement for connecting to the data-lake service with the added certificate.

I hope this makes some sense.

Re: Device Certificate - Where to find OTP?

Klaverblad — Fri, 25 Sep 2020 07:00:31 GMT

I understand I am not required to allow telemetry. That is not my concern in this.

After the upgrade to 9.1.2+ a high/red alert is repeatedly shown in the system logs that telemetry is simply not configured and cannot be used until, according to the procedure, the certificates are in place.

If anyone is not required to allow telemetry why didn't they choose to:

- Make enabling telemetry participation an opt-in feature, or

- Add a more intuitive notification AND alert (informational): "Telemetry is not configured. Please see manual how to enable it."

Just adding a high alert to the system logs, because a new feature is not configured is unnecessary and created some confusion.

Missing/faulty/expired certificates is typically a bad thing and often does need immediate attention. In this case it does not.