Panorama 8.0 - EDL & Certificate Profile

Reply
Highlighted
L2 Linker

Panorama 8.0 - EDL & Certificate Profile

Hi all, 

 

I just ran into an issue while creating an External Dynamic List in Panorama 8.0. The source is a HTTPS address that requries a certificate profile for validation, so far so good. The problem is that I can't select any certificate profile, the list is empty. There's a certificate profile created under Device > Certificate Management > Certificate Profile for a template. 

 

Any suggestion what can be wrong or how to do this in a correct way?

 

Capture.JPG

 

Capture.JPG

 

Br,

Per Tenggren

Br.
Per Tenggren

Accepted Solutions
Highlighted
L2 Linker

After further investigation it seems that EDL created as "shared" can't list any certificate profile, but it works if assigning the EDL to a specific device group.

Br.
Per Tenggren

View solution in original post


All Replies
Highlighted
L4 Transporter

Hi PerTenggren,

 

Thanks for posting in the community forums!

 

I tested this out.


Verify if the firewall is also running 8.0. I can replicate this behavior if the Panorama is 8.0 while the firewall is pre-8.0. Secondly, check from the firewall itself, if you are able to create a EDL(with https link) and associate a certificate profile. This is an excerpt from the Admin Guide of the Panorama:

 

If the external dynamic list has an HTTPS URL, select an existing certificate profile (firewall and Panorama) or create a new Certificate Profile (firewall only) for authenticating the web server that hosts the list. For more information on configuring a certificate profile, see Device > Certificate Management > Certificate Profile.
Default: None (Disable Cert profile)
To maximize the number of external dynamic lists that you can use to enforce policy, use the same certificate profile to authenticate external dynamic lists that use the same source URL so that the lists count as only one external dynamic list. External dynamic lists from the same source URL that use different certificate profiles are counted as unique external dynamic lists.

 

Hope this helps.

 

Regards,

Anurag

================================================================
ACE 7.0, 8.0, PCNSE 7
Highlighted
Cyber Elite

First guess would be that you are missing the intermediate cert on your cert profile. The full chain needs to be included ...because reasons ;) 

Highlighted
L2 Linker

After further investigation it seems that EDL created as "shared" can't list any certificate profile, but it works if assigning the EDL to a specific device group.

Br.
Per Tenggren

View solution in original post

Highlighted
L4 Transporter

Tested that and yes, you are correct! This makes sense to me, as it cannot check whether it's present on a particular device group or not, within a configuration piece.
================================================================
ACE 7.0, 8.0, PCNSE 7
Highlighted
L2 Linker

I ran into the same issue.  Seems to be a design issue depending on your device group hierarchy.  In my case my firewalls are in a DG under an organizational DG.  For example shared > datacenter firewalls > data center A.  The issue is that I am managing security policy in the "datacenter firewalls" DG, which doesn't have any devices assigned to it - this is the issue.   But I'm not able to create an EDL in the "datacenter firewalls" DG and reference a cert file from the template.  I hope Palo dev fixes this.

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!