Scheduled backup export

[Netzer]

Hi there,

I have a scheduled backup job running every night, which exports my Panorama config to a backup server, it is running for over a year now without any problem.

Yesterday I went over the config, changed the time and permitted the config.

This morning I saw that the backup failed due to missing ECDSA SSH key.

Failed exporting config bundle via ssh to 1x.xx.xx.xx. No ECDSA host key is known for 1x.xx.xx.xx ...Host key verification failed...lost connection

The test connection button on the backup schedule page asks if I want to add the key, system says it added the key but it seems to do nothing. Same message when I press the button again, same error message when the backup job runs again.

Im on Panorama version 10.2.2

Has anyone a hint how to fix or work around that issue?

[Patrick_Oberli]

Just had a case open with Palo support. It's not yet fully fixed and scheduled for 10.2.4-H3 and 10.2.5. 

[SusanACollins]

Yes the only other way beforehand is to get them to give you the root password but that is only possible if no remote access is permitted.   It really is a simple task to run the normal root commands to fix it once you get in!  I feel very frustrated they refuse to give that out.  Been using Unix for many years now and its a bit of an insult to one's integrity!  Other vendors do not seem to have this restriction.....

[Brooks_Hassinger]

That fix they do is temporary, the scheduled config exports will work for a few weeks then it will break again.

[SusanACollins]

I can understand if you patch the system it might break as that may well overwrite the root directories, but mine have been backing up now for the last 6 weeks since fixing...

[Brooks_Hassinger]

Ours broke twice without any changes

[Toivo]

10.2.4-h2 -- tried to follow the KB article, but after deleting the host keys and attempting the connection, it's successful (same via GUI). Consequently there's nothing displayed that can be manually added. The scheduled export still fails. Any other ideas?

[Patrick_Oberli]

It's not yet fixed. It should be in 10.2.5 and maybe 10.2.5-h3. Until then you have to open a support case and they need to login with root and then make an ssh session from the Panorama to the backup server and store the key.

[dfiederling]

I updated last week to 10.2.4-h3 and SCP backup export still works. To me, it seems that it has been fixed in 10.2.4-h3 even if there is no fixed issue listed for 10.2.4-h3 release.

bye

Daniel

[Patrick_Oberli]

As far as I can tell, it breaks in the following two circumstances:

- fresh setup

- SCP backup server generates new keys

If it already was working on an older version, it should continue to work after updating Panorama. 

[Amine]

Yes, it is fixed in 10.2.4-h3 - issue ID PAN-218620

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-4-known-and-addressed...

[CKobelsky]

I recently upgraded from 10.2.4 to 10.2.6 and once I did the scheduled export job started working.  I didn't have to reset anything, just entered in the info, set a time, and away it went