LSVPN Satellite fails to authenticate

[GeorgeAPH]

Hello

I'm struggling to setup a (not so) large scale VPN solution with one PA-820 ha pair and three PA-410 satellites. I'm using local CA in PA820. At some point I had some success - portal connection succeeded and certificates were issued to satellite, however gateway connections didn't worked. Then I realized that I leaved local CA lifetime to default 365 days, which is not acceptable for a CA, so I made a renew of CA certificate. From that point on I'm in a series of all kind of certificate and authentication errors. I even factory erased PA-410 two times, deleted and recreated CA, Portal(s) Gateway(s) to no success.

My current problem is that LSVPN portal does not recognize satellite. It says "Fail to find device from config". I checked several times portal config, deleted and recreated it, added again satellite's serial numbers using copy/paste from satellite dashboard page - nothing helped! I'll be grateful if someone points me where to look for cause or is there some CLI command which could help me to debug this or to clear some certificate or cookie cache so I can start over from clean config. Here is the error I see in the monitor: 

Versions of both firewalls are 10.1.x (the last number differs, but I don't think it's a problem)

regards, George

[reaper]

Have you considered setting up regular dynamic ipsec tunnels? They're a little more work, but since you have very few firewalls that should not be a biggie, but it will be so much easier to troubleshoot since you can rely on actual logs (and debug commands) that tell you what is going on vs the globalprotect version

You'll also have more control over which encryption is used etc... 

[GeorgeAPH]

Your proposal seems more than reasonable now, after spending so much time with something which is supposed to be more easy and straightforward, being native to Palo Alto. 

[Raido_Rattameister]

Another vote for regular IPSec tunnels.

Satellites are more hassle and no real benefit.

Even with more tunnels just export out VPN setup in set commands to avoid clicking through all in GUI.