LSVPN Satellite fails to authenticate

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

LSVPN Satellite fails to authenticate

L1 Bithead

Hello

I'm struggling to setup a (not so) large scale VPN solution with one PA-820 ha pair and three PA-410 satellites. I'm using local CA in PA820. At some point I had some success - portal connection succeeded and certificates were issued to satellite, however gateway connections didn't worked. Then I realized that I leaved local CA lifetime to default 365 days, which is not acceptable for a CA, so I made a renew of CA certificate. From that point on I'm in a series of all kind of certificate and authentication errors. I even factory erased PA-410 two times, deleted and recreated CA, Portal(s) Gateway(s) to no success.

 

My current problem is that LSVPN portal does not recognize satellite. It says "Fail to find device from config". I checked several times portal config, deleted and recreated it, added again satellite's serial numbers using copy/paste from satellite dashboard page - nothing helped! I'll be grateful if someone points me where to look for cause or is there some CLI command which could help me to debug this or to clear some certificate or cookie cache so I can start over from clean config. Here is the error I see in the monitor: 

 

GeorgeAPH_0-1684838429150.png

 

Versions of both firewalls are 10.1.x (the last number differs, but I don't think it's a problem)

regards, George

3 REPLIES 3

Cyber Elite
Cyber Elite

Have you considered setting up regular dynamic ipsec tunnels? They're a little more work, but since you have very few firewalls that should not be a biggie, but it will be so much easier to troubleshoot since you can rely on actual logs (and debug commands) that tell you what is going on vs the globalprotect version

You'll also have more control over which encryption is used etc... 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Your proposal seems more than reasonable now, after spending so much time with something which is supposed to be more easy and straightforward, being native to Palo Alto. 

Cyber Elite
Cyber Elite

Another vote for regular IPSec tunnels.

Satellites are more hassle and no real benefit.

Even with more tunnels just export out VPN setup in set commands to avoid clicking through all in GUI.

 

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
  • 1217 Views
  • 3 replies
  • 0 Likes
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!