topic Re: Getting invalid candidate configuration error while changing master key in General Topics

Getting invalid candidate configuration error while changing master key

nithinbabup — Thu, 01 Oct 2020 07:18:28 GMT

Hi,

I am in a task to change master key of a active standby pair.

I have followed all the instruction recommended by palo alto but while clicking "ok" after providing new key its getting invalid "candidate configuration.master key change aborted" error message.

If any one has any suggestions on this, please write.

Re: Getting invalid candidate configuration error while changing master key

Rene_Boehme — Thu, 01 Oct 2020 17:58:37 GMT

Hi,

first of all I wont recommend touching the master key and only if necessary. When prompted to enter the new key,

- how do you handle to the "current key" field?

- what do you enter to the rest of the fields?

I guess you can not go without either "reminder" or "auto key renewal". Has the master key changed before or is it default?

Re: Getting invalid candidate configuration error while changing master key

BPry — Thu, 01 Oct 2020 22:03:07 GMT

@nithinbabup,

Modifying the master key is fine, but I would recommend that this should be done with caution. The last thing that you want to do is let a master key expire because you didn't setup reminders or nobody else knows that it's something that's going to need to be looked after.

The first thing that I would check is that there isn't any other pending changes, the master key update will fail unless all pending changes have been cleared or committed to the firewall.

Re: Getting invalid candidate configuration error while changing master key

nithinbabup — Fri, 09 Oct 2020 10:36:56 GMT

HI All

We have fixed the problem.

Action taken: All the configurations from template are over ridden after that the given master key has been accepted.