Getting invalid candidate configuration error while changing master key

[nithinbabup]

Hi,

I am in a task to change master key of a active standby pair.

I have followed all the instruction recommended by palo alto but while clicking "ok" after providing new key its getting invalid "candidate configuration.master key change aborted" error message.

If any one has any suggestions on this, please write.

[Rene_Boehme]

Hi,

first of all I wont recommend touching the master key and only if necessary. When prompted to enter the new key,

- how do you handle to the "current key" field?

- what do you enter to the rest of the fields?

I guess you can not go without either "reminder" or "auto key renewal". Has the master key changed before or is it default?

[BPry]

@nithinbabup,

Modifying the master key is fine, but I would recommend that this should be done with caution. The last thing that you want to do is let a master key expire because you didn't setup reminders or nobody else knows that it's something that's going to need to be looked after.

The first thing that I would check is that there isn't any other pending changes, the master key update will fail unless all pending changes have been cleared or committed to the firewall. 

[nithinbabup · Accepted solution]

HI All

We have fixed the problem.

Action taken: All the configurations from template are over ridden after that the given master key has been accepted.