Panorama Certificate question

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Panorama Certificate question

L2 Linker

In pamorama I created a default template with basic configuration settings for all firewalls and then create a site specific template and put them both in a template stack to apply the stack to each firewall. This way the default settings apply to all firewalls for consistancy and we can apply site specific settings like individual rules. This works great so far. 

 

One of the default settings we pushed out is a wildcard cert and a ssl/tls service profile so that we can use our domain to secure communication to the management web sites over SSL. This works great. 

 

Later I setup global protect vpn for remote clients to connect. I  am doing this on only 1 locaiton currnetly so I made these changes to the site specific template and not the default template. When I go to add the cert and the TLS profile in the site sepecific template it doesnt see the cert or ssl/tls service profile pushed out with the default template even though its the same wildcard cert. I installed the cert and in the site specific template and created a new service profile and global protect works fine. 

 

The issue is every time I commit to this firewall group now I get an error saying duplicate certificate subject found. 

 

What is the best way to fix this? I thought maybe I had to make the change on the stack rather than the individual certs but everything is read only when I go to modify the stack. 

 

Everything is working fine but my OCD finds it really annoying that the commit comes back with succedeed with warnings. 

3 REPLIES 3

L2 Linker

Hi @dstjames,

 

Yes that is how it would work you cant reference template values across in a stack.

 

Have you kept the same name while importing the certificates (Display Name) in both the templates ?

 

If you keep the same name (try rename) in both the templates then the default template should supersede and only one certificate should get imported which should take care of your Warning.

 

 

The old certificate should ideally be deleted with Panorama push and only one certificate should reflect in the Firewall.

 

Thanks for the reply. 

 

Yeah I put them in as different names. 

 

If I go to the firewall directly rather than through panorama I do see that it installed both certs and both tls serivce profiles. Since these are technically both the same cert thats why when I commit its telling me I have a duplicate subject name. 

 

Just not sure what the best practice is to use the same cert in both scenarios? I guess I could remove it from the default template and put all the cert settings in the site specific template. I was just hoping there was a better way. 

 

Yes usually as best practice it is recommended to use different certificates.

 

Using it in individual templates than default in the stack will also solve this problem or the other way is to keep same display name for the certificate in default template and nested template, this way you can still deploy the certificates through default template to other firewalls.

  • 3720 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!