We have 2 Palo alto firewalls in HA mode (Active-standby).
Palo alto mode: PA-3220
OS Version: 10.1.6-h3
We create Unique certificates (for management, interdevice) in each firewall with hostname. After some time, the certificates in secondary firewall gets removed and the certificates from primary firewall are copied into secondary firewall..
For example: Primary firewall hostname and certificates: Hostname:PrimaryFW Certificate name: PrimaryFW
Secondary firewall hostname: SecondaryFW; Certificate name: SecondaryFW
Hi @Sai14091990 ,
According to documentations certificates are not synced between Active/Passive HA member - What Settings Don’t Sync in Active/Passive HA? (paloaltonetworks.com)
There is very important note mentioned on that link
So what you experience shouldn't be normal, and I suspect that you are using different certificate names. Don't confuse Common Name (CN) with name - latter is the name of the certificate object you put when importing/generating the certificate.
Try to import the certificate for secondary member again and set exactly the same name as the mgmt certificate on the primary member and see if this will help.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!