About kbe

Done a migration from 3020 to 3410. But no HA, no Panorama. Interfaces where no problems between 3020 and 3410. I do not know the 3050, so please check before if interfacec match concerning numbering and type.   Bring the 3050 to the latest OS. Export the config and export the device state. Prepare the 3410, upgrade OS, upload apps update, etc. but do not put it in production environment.   Import the device state from 3050 (so all certs are also imported which are not part of the config). Check config, name, mgmt IP,... I had to correct some issues in the config directly in the xml but this was no big deal. After device state import i got a commit error Result Failed Details Validation Error: log-settings -> correlation unexpected here log-settings is invalid shared is invalid Exported the running config, deleted something from correlation logs in the xml, imported the xml and then commit worked.   Biggest issue i had after putting it in production: Encryption worked but after some days any traffic went down and 3410 neede to be restarted. Thena same error after about 5-7 days. It' s a known issue in 10.2.3 PAN-206005 when in decryption strip ALPN is not selected. Also have some trouble with daily PDF reports. TAC says it will be fixed in 10.2.4.   HTH   ... View more

Hi Kim   same problem here. TAC had 3 seesions but no solution right now. But tAC did not mention PAN-195893 and i do not find any information in the known issues. Running 10.2.3 on a new 3410 which was migrated from a 3020 running 9.1.14 with import of device state. On the 3020 the pdf summary worked. Are there any more infos? Removing all application reports from the pdf summary makes no difference. The only part that shows some data is the threats summary. URL, Traffic etc. are just blank pages. But the complete report (build of summary report and single reports is mailed every day but with a bunch of blank pages.   TIA ... View more

It´s a 3410. When i had this problem the first time it was on a 3020 after the 9.1.x OS release came out which brought this certificate up for the first time. Maybe it´s only a problem the first time the autorenew runs after the first 3 months passed.  How old ist your 440? Was it also the first autorenew after bringing the device up?  ... View more

Hi @Pras    I decided to give it a try before the TAC session for my other problem.   I requested the OTP on the support portal. I klicked the "Get Certificate" under Setup-Management-Device Certificate, pasted the OTP and got the following error   I gave it a second try by ssh to the Palo, issued a  request certificate fetch otp <value> where <value> is the copied OTP and recieved an "invalid syntax" error.   So i just fired a  request certificate fetch in the ssh session and it worked. Cert was renewed.   Hope this helps you. cu     ... View more

Hi   no good news. Renew failed again. But the URL certificatetrusted.paloaltonetworks.com is answering. I have a TAC session today for another problem and will aks if there is a known problem. I guess i have to use the manual method with OTP and then wait for the next autorenew to see if it works the next time. Will let you know when i have news.   cu ... View more

I did a manual renew with an OTP. After that it renewed the next time after 3 months.   But right now since last night i have the same problem on a new PA that tried it for the first time last night. But the URL for renew is not answering at the moment so i do not want to go the manual way and revoke the actual cert which is still valid for a few days. Maybe Palo has a problem at the moment. I will wait till tomorrow. ... View more

Our PA failed last night with renew. Seems like certificatetrusted.paloaltonetworks.com is not reachable at the moment. So i do not try the manual method which revokes the actual cert. I will wait another day and see what happens this night.   Last time i head the problem that the renew did not work is a while ago on my older 3020 with 9.1.x running. I only had to manually renew it for one time and after that it did the autorenew.   The PA with PanOS 10.2.3 that i have running now is new an running since November, so this would be the first renew now. But i will not try the manual renew until certificatetrusted.paloaltonetworks.com/ is reachable again.   I also lowered the MTU according to this article (but i did it this morning so it was on MTU 1500 last night when it failed). https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NlxCAE     ... View more

The Palo normally fetches a new cert by itself before the other expires. There should be no need to get it manually under normal conditions. I see a link with get certificate wich i used the last time (see my older posting from 2021-03-18).     ... View more

Ok, thanks for your help. Now i can be sure that EU does not match all EU countries. Last question: Do you know if override a region with IPs just adds the manual IPs to the original region or does it replace the original region and only uses the manual added IPs? ... View more

Thanks for the information. This helps alot. How did you find this information? Is there any docu concerning the EU region and what it is catching up? Any way to find out what is covered by EU, other than wait until something hits the logs and shows up as EU? cu   ... View more

As i mentioned in my post Failed to renew device certificate :   The Root CA Palo Alto Networks Inc.-Root-CA G1 that signed the cert for certificatetrusted.paloaltonetworks.com is not trusted if you browse to the url. But i do not see any deny or block or other errors concerning this. I did not find any other clues for the problem. ... View more

Same problem here. A single PA3020 did not renew the cert. I opened 2 days ago another thread. Today i requested a new cert with OTP as a workaround. Will see what happens in 3 Months or if there comes up another solution. ... View more

Today i requested a new OTP and choose to Get Certificate on the PA which revokes the actual cert and requests a new one. The new Cert request finished without problems. Now i wait til 16-06 to see if the next renew will work automatically or if the problem comes up again. ... View more

Last traffic to ( url eq 'certificate.paloaltonetworks.com' ) was on 12/29 when the certificate was installed the first time. No block / deny or other traffic to this url or ip since then.   Seems the PA ist trying to connect to 35.238.43.180 and there is no deny for it. The mgmt interface has an allow rule but the renew is not working. This was the traffic from the last 2 days to https://certificatetrusted.paloaltonetworks.com/     The Root CA Palo Alto Networks Inc.-Root-CA G1 that signed the cert for certificatetrusted.paloaltonetworks.com is not trusted if you browse to the url. But that should not be the problem.   ... View more