Scheduled backup export

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Scheduled backup export

L2 Linker

Hi there,

 

I have a scheduled backup job running every night, which exports my Panorama config to a backup server, it is running for over a year now without any problem.

 

Yesterday I went over the config, changed the time and permitted the config.

This morning I saw that the backup failed due to missing ECDSA SSH key.

 

Failed exporting config bundle via ssh to 1x.xx.xx.xx. No ECDSA host key is known for 1x.xx.xx.xx ...Host key verification failed...lost connection

 

The test connection button on the backup schedule page asks if I want to add the key, system says it added the key but it seems to do nothing. Same message when I press the button again, same error message when the backup job runs again.

 

Im on Panorama version 10.2.2

 

Has anyone a hint how to fix or work around that issue?

20 REPLIES 20

L2 Linker

Hi @Netzer 

 

You can follow this Knowledgebase Article which can be of help.

 

Regards,

Arnesh

 

I tried it two times but still the same error. SCP from CLI works, but the scheduled task still doesn't and is throughing the same error.

Is anyone using FTP for config export? I installed vsftpd on SLES, a standard ftp client can connect normally, the export job in Panorama cannot login - Login incorrect.

 

What a **bleep** mess....

L2 Linker

I'm setting up a new Panorama system (version 10.2.2-h1) and I'm having the same issue.  Can't get schedule config export working at all (either using FTP or SCP).

Did you try the suggestion from ahandoo? I had no luck with it.

Did the update to 10.2.2-h1 during weekend but still the same situation, seems to be a bug. Is there any way to report this issue officially to Palo Alto Networks?

 

Is it possible to create the scheduled backup via CLI?

L2 Linker

Yes I tried that, no dice.  It seems like it isn't storing the host key at all.  I'm not sure if you can make a scheduled backup from the CLI, but considering what I'm seeing I don't think that will help.

L2 Linker

Hi @Netzer , @CKobelsky 

 

Ideally, the device should update the ssh key in the known-hosts file after following the article. It is interesting to know that the CLI test work fine but the schedule for config export.

As it does not work, then the TAC may access the known-hosts file to check if there are any issue or if this is any Bug.

Have you tried reaching out to the TAC regarding this?

 

Regards,

The article commands react like this.

 

2022-07-26 13_06_00-10.214.102.34 - PuTTY.png

 

Looks good but it doesn't fix the problem with the scp export.

The only option what works for me is anonymous ftp.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!