05-23-2023 03:59 AM
I'm struggling to setup a (not so) large scale VPN solution with one PA-820 ha pair and three PA-410 satellites. I'm using local CA in PA820. At some point I had some success - portal connection succeeded and certificates were issued to satellite, however gateway connections didn't worked. Then I realized that I leaved local CA lifetime to default 365 days, which is not acceptable for a CA, so I made a renew of CA certificate. From that point on I'm in a series of all kind of certificate and authentication errors. I even factory erased PA-410 two times, deleted and recreated CA, Portal(s) Gateway(s) to no success.
My current problem is that LSVPN portal does not recognize satellite. It says "Fail to find device from config". I checked several times portal config, deleted and recreated it, added again satellite's serial numbers using copy/paste from satellite dashboard page - nothing helped! I'll be grateful if someone points me where to look for cause or is there some CLI command which could help me to debug this or to clear some certificate or cookie cache so I can start over from clean config. Here is the error I see in the monitor:
Versions of both firewalls are 10.1.x (the last number differs, but I don't think it's a problem)
05-23-2023 09:11 AM
Have you considered setting up regular dynamic ipsec tunnels? They're a little more work, but since you have very few firewalls that should not be a biggie, but it will be so much easier to troubleshoot since you can rely on actual logs (and debug commands) that tell you what is going on vs the globalprotect version
You'll also have more control over which encryption is used etc...
05-23-2023 09:29 AM
Your proposal seems more than reasonable now, after spending so much time with something which is supposed to be more easy and straightforward, being native to Palo Alto.
05-23-2023 01:39 PM
Another vote for regular IPSec tunnels.
Satellites are more hassle and no real benefit.
Even with more tunnels just export out VPN setup in set commands to avoid clicking through all in GUI.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!