|
March 1, 2024
Introducing the NGFW/Panorama Management
Certificate Expiration alert that detects the
upcoming expiration of the NGFW or Panorama Management
certificate on devices by April 7, 2024. When these certificates
expire, it results in a loss of connection between Panorama and
NGFWs, M-Series appliances operating in PAN-DB private cloud
mode, WildFire appliances (WF500/B), and Peer Panoramas,
regardless of their management or Log Collector modes.
Consequently, expired certificates compromise centralized
management and visibility, posing security risks and operational
inefficiencies. This alert helps you identify the PAN-OS devices
within your network that are susceptible to this issue and
provides information about the remediation options. The NGFW/Panorama Management Certificate
Expiration alert assesses the following
criteria:
-
Checks if Panorama is managing the device.
-
-
Checks if a custom certificate is being used
for Device-Panorama connectivity.
-
Checks if the dynamic content update version
is greater than or equal to 8795-8489 on all NGFWs,
Panorama, and log collectors.
-
Checks if the firewall has rebooted at least
once after the content package update.
This alert is triggered if it meets all the following
conditions:
-
Panorama manages the device.
Unmanaged devices and those managed by
Strata Cloud Manager are exempt.
-
The device is running an older software version
and it's not using a custom certificate for
Panorama-NGFW-LC connectivity.
-
The device either has a content package version
prior to 8795-8489 or a version exceeding 8795-8489 but
has not undergone a reboot since the content package
installation.
If these conditions are met, a critical alert is
generated notifying you about NGFW/Panorama management
certificate expiry.
The device remains unaffected if either condition 1 or
2 fails. If this alert is active, it's closed upon the failure
of either condition 1 or 2.
| 