Add Device Authentication Failure

[UNMPDgordon]

More of an advice posting than a request for assistance.

Do not make your PA firewall admin password really crazy long and complex (like I did ~ at 19 characters long).

If you do, you might get tripped up by Expedition when you try and add a device and the user API keys.

Background:

New PA-440 Firewall (FW)

Stood up Expedition VM on Monday the 21st.

I kept getting "Invalid Credential" in Expedition when trying to add the API key for admin with my crazy long complex pwd.

I was able to SSH from the Ubuntu Server to the FW using admin with its 19-character long password so was greatly puzzled why Expedition was bombing out. Even opened a case on PA support. Lots of inconclusive results found.

After a zoom session a short time ago with my local PA VAR and a SE with PA, I found a clue to a possible solution in the /home/userSpace/devices/debug.txt file: only part of that long booger of a pwd was being transmitted to the FW so of course(!) authentication is going to fail! As an aside, I find it curious that the pwd used is in clear text in the debug.txt file!

After changing my FW admin pwd to something that _just_ meets the security requirements (8 long, one cap, 5 lower and 2 bangs), committing, signing out of everything, signing back into Expedition, adding my device and using the shorter admin pwd, the add succeeded and the 3 keys were populated!

[M.Anderson]

I'm running into the same issue.  PWD = 9 characters, upper case, lower case, number, special character #

Any recommendations?

[lychiang]

@M.Anderson Try to remove the special character and try again, if it's still not working, you can try create a new user account on the firewall and assign the API read permission. 

[M.Anderson]

I did both.  Added a new user account with API read permissions, as well as removing the special character.  Thank you sir!

[AnthonyPacheco]

any resolution to this? I've tried username/password, api login, removal of special characters, etc 

[dpuigdomenec]

Hi @AnthonyPacheco 

Try to execute the external command and later in Expedition create the device and add directly the created API_KEY

curl -H "Content-Type: application/x-www-form-urlencoded" -X POST https://firewall/api/?type=keygen -d 'user=<user>&password=<password>'

Reference article: https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-panorama-api/pan-os-api-authentication/get-your...

Hope this helps,

David