service certificate push from panorama to managed firewalls eg: vpn

[zaidshaikh]

Hi folks,

We have panorama and few pairs to managed firewalls being managed by panorama,

Under the Templates, created CSR and imported the signed CA and pushed it to specific template firewall(say FW01-active), the managed firewall local configurations displays the new certificate, however, on the FW02-passive one the certificate did not sync.

Do we need to separately push to FW02 template, by creating csr and same procedure? since its the vpn service certificate, it should sync from the active-FW01.

Note: Templates care configured for each firewall separate (eg: FW01-Template ; FW02 Template so on)

[PavelK]

Hello @zaidshaikh

thanks for post.

Based on documentation: What Doesn't Sync in Active/Passive HA? most of the certificates and certificate related configuration does not sync in HA deployment. It specifically does not call out a certificate used for VPN, however personally I believe it is a root cause. I would add the certificate to the Template associated with FW02.

Kind Regards

Pavel

[zaidshaikh]

Hi Pavel,

Thank you for the response.

Presently the panorama is provisioned to managed 4 pairs of firewall, each pair is in A-P. What i found is that for each firewall let say FW01-Active has a individual Template and Template stack similarly for FW02-passive has individual T and TS.

Now with regards to s2s vpn cert based authenticate, i want to know if i generate a csr from each firewall template with similar CN: contoso.abc.com and import it into each firewall Template and Push.

Will the VPN will work after failover is trigerred? when old passive FW02 becomes new active? Assuming that similar CN will suffice for th tunnel to get establish with no issues.