Certificates duplicated from Primary to Secondary firewall in Palo alto

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Certificates duplicated from Primary to Secondary firewall in Palo alto

L0 Member

Hi All,

 

We have 2 Palo alto firewalls in HA mode (Active-standby).

Palo alto mode: PA-3220

OS Version: 10.1.6-h3

 

We create Unique certificates (for management, interdevice) in each firewall with hostname. After some time, the certificates in secondary firewall gets removed and the certificates from primary firewall are copied into secondary firewall..

 

Cyber Elite

 

For example: Primary firewall hostname and certificates: Hostname:PrimaryFW Certificate name: PrimaryFW

Secondary firewall hostname: SecondaryFW; Certificate name: SecondaryFW

 

After some time,, the seconday firewall certificates are deleted, and the primary firewall certificates are visible in the secondary firewall.. is it a bug? @aleksandar.astardzhiev @Jafar_Hussain @DelvinC 

1 REPLY 1

Hi @Sai14091990 ,

According to documentations certificates are not synced between Active/Passive HA member - What Settings Don’t Sync in Active/Passive HA? (paloaltonetworks.com)

 

There is very important note mentioned on that link

Astardzhiev_0-1669705997954.png

 

So what you experience shouldn't be normal, and I suspect that you are using different certificate names. Don't confuse Common Name (CN) with name - latter is the name of the certificate object you put when importing/generating the certificate.

 

Try to import the certificate for secondary member again and set exactly the same name as the mgmt certificate on the primary member and see if this will help.

  • 1606 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!