Web Auth FW with HA

[Alpalo]

Hello,

I am configuring Webauth with certificate on my FW cluster and currently the access to the active FW is correct.

I have created CA and client certificate correctly, the problem I am facing to access the passive node,

is it necessary to create another CA also for the Passive FW?

Is there any way to have a single CA for the cluster?

Can anybody helps me?

Greetings.

[PavelK]

Hello @Alpalo

thanks for post!

You will have to import the certificate to passive Firewall and then create SSL/TLS profile. These configurations are not synchronized between Active / Passive Firewalls: what-settings-dont-sync-in-activepassive-ha:

Kind Regards

Pavel

[Alpalo]

Hi team,

@PavelK i tried with your recommendation but problem still continues, I followed the procedure : https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcCCAS adn Web auth with certificate works fine with Active node, but I cannot access to the passive node 😞 Any idea?

Regards

[PavelK]

Hello @Alpalo

thank you for reply.

Could you confirm that passive Firewall has all required certificate / certificate chain used in certificate profile?

Could you check what authentication logs say in passive Firewall when authentication fails: tail follow yes mp-log authd.log?

Kind Regards

Pavel