PA-450 License Issue

[Sanjay_Ramaiah]

Hi Team,

Is there any known issues with the License Tab in PA-450 as our new firewall is not showing anything on the license TAB. I have added the devcie in the support portal but to fetch the license i am not able to see anything in the tab. I upgraded the device from 10.1.0 to 10.1.8 just to check if it helps but no use.

Regards,

Sanjay S

[Metgatz]

Hello @Sanjay_Ramaiah , good evening

Make sure that through the MGT interface your Firewall has access to the Internet, you can test from CLI/SSH ping host updates.paloaltonetworks.com. Make sure it responds and resolves.

Make sure you have set the DNS so that the firewall can resolve the addresses.

Once you have validated these two points, re-apply a Retrieve Lincense, in the licensing section.

Regards

[Sanjay_Ramaiah]

Thank you Metgatz for the quick response.

I think i found the issue. It looks to be permissions issue. The user created is Devcie Administrator and this is the only user account 😞 . I am now not able to create a new administrator with Superuser access. 

Is there anyway i can create the superuser access for this now? 

[Metgatz]

You must have superuser privileges to create an administrative user with superuser privileges

[Sanjay_Ramaiah]

Looks like there is only one user now and that too with the Device Administrator permissions 😞

Is it possible to push it via Panorama?

[Metgatz]

Yes, if you have superuser in PANORAMA, you can create a push a SuperUser on the target device.

And what happened to the default admin of the firewall ? and that account, what happened to it ? was it renamed or deleted for security reasons ?

Regards

[Sanjay_Ramaiah]

Unfortunately to add to Panorama also i need SuperUser access. This was taken from the box and one of our team members set the basic config and gave me the access. Not sure what all has been done. Will check on that. If not can we do Factory reset at least from the Device Administrator account?

[Metgatz]

What ? You also don't have a Panorama superuser?

If you have superuser access with PANORAMA, then don't push from the template, but rather switch context, from Panorama, and select the firewall, it's as if you were standing directly on the firewall and you already create the user superuser.

Panorama Context Switch

https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/panorama-overview/centralized-firewall...

Now if this does not work, then take a backup, snapshot of the configuration, so that after the hard reset or the factory reset you can import that backup, but make sure to check the Administrator section and see and/or generate a superuser, so that Don't have problems and/or some other lastresort superuser account.

Now for the reset you must restart the equipment and follow these steps:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CldXCAS

The other option, if you previously had the user, or the password, in some other backup, that is, before deleting or changing the password, you could also eventually load that config.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkxCAC

But if nothing works anymore, then it only remains to restore.

Cheers

[Sanjay_Ramaiah]

Hi Metgatz,

Problem is this is very new firewall and i am configuring it now. There is no connectivity to Panorama to this device yet. So to setup the connectivity to Panorama it is asking for the SuperUser permissions 😞

I think 2nd option suggested would be much better. But again while importing the Snapshot will not have impact on the Administrators in the Snapshot?

[Metgatz]

Hello @Sanjay_Ramaiah 

Well, with the backup, with the snapshot of the Firewall config ( remember export snapshot backup to your laptop/PC ), once you do the factory reset import and load the snapshot and look at the Device Administrator section, as you will be with the "admin" default super user, you make sure to create a backup superuser and to check that the admin does not disappear. And any other user/accounts that you have in the firewall or have created, will be in the snapshot.

Cheers