Panorama 8.0 - EDL & Certificate Profile

[PerTenggren]

Hi all, 

I just ran into an issue while creating an External Dynamic List in Panorama 8.0. The source is a HTTPS address that requries a certificate profile for validation, so far so good. The problem is that I can't select any certificate profile, the list is empty. There's a certificate profile created under Device > Certificate Management > Certificate Profile for a template. 

Any suggestion what can be wrong or how to do this in a correct way?

Br,

Per Tenggren

[ansharma]

Hi PerTenggren,

Thanks for posting in the community forums!

I tested this out.

Verify if the firewall is also running 8.0. I can replicate this behavior if the Panorama is 8.0 while the firewall is pre-8.0. Secondly, check from the firewall itself, if you are able to create a EDL(with https link) and associate a certificate profile. This is an excerpt from the Admin Guide of the Panorama:

If the external dynamic list has an HTTPS URL, select an existing certificate profile (firewall and Panorama) or create a new Certificate Profile (firewall only) for authenticating the web server that hosts the list. For more information on configuring a certificate profile, see Device > Certificate Management > Certificate Profile.

Default: None (Disable Cert profile)

To maximize the number of external dynamic lists that you can use to enforce policy, use the same certificate profile to authenticate external dynamic lists that use the same source URL so that the lists count as only one external dynamic list. External dynamic lists from the same source URL that use different certificate profiles are counted as unique external dynamic lists.

Hope this helps.

Regards,

Anurag

[BPry]

First guess would be that you are missing the intermediate cert on your cert profile. The full chain needs to be included ...because reasons 😉 

[PerTenggren · Accepted solution]

After further investigation it seems that EDL created as "shared" can't list any certificate profile, but it works if assigning the EDL to a specific device group.

[ansharma]

Tested that and yes, you are correct! This makes sense to me, as it cannot check whether it's present on a particular device group or not, within a configuration piece.

[ice-quake]

I ran into the same issue.  Seems to be a design issue depending on your device group hierarchy.  In my case my firewalls are in a DG under an organizational DG.  For example shared > datacenter firewalls > data center A.  The issue is that I am managing security policy in the "datacenter firewalls" DG, which doesn't have any devices assigned to it - this is the issue.   But I'm not able to create an EDL in the "datacenter firewalls" DG and reference a cert file from the template.  I hope Palo dev fixes this.