How to replace an RMA firewall with HA encryption enabled

• When HA between firewalls is configured with encryption enabled, both firewalls need to have exchanged HA keys (SSH keys).
• SSH keys are cryptographically bound to physical hardware for security integrity.
• New RMA firewall is coming without (or with default) SSH keys - this is the reason, new SSH keys needs to be generated and exchanged during RMA device replacement activity to successfully import device state and establish an encrypted HA1a interface on an RMA replacement unit without triggering security guardrails that block the connection due to hardware mismatch.
• Procedure described below requires both firewalls to reboot.

• PAN-OS 10.2 and above
• Palo Alto Firewall
• High Availability (HA) setup with HA encryption enabled
• RMA replacement unit

Prerequisites

• Licenses transferred from old firewall to new one in CSP
  How to Transfer Licenses to a Spare Device
• Device state applied on new RMA firewall
  How to Configure an RMA Replacement Firewall

1. Replace the hardware and import the device state onto the RMA replacement unit.
   
   
2. Disable HA encryption on both firewalls prior to finalizing the RMA setup to avoid triggering the hardware mismatch security guardrail. Device > High Availability > HA Communication > HA1
   
    
   and Commit changes.
   At this point devices should work correctly in an HA without encryption.
   
   
3. Suspend HA for RMA replaced firewall. Device > High Availability > Operational Commands > 'Suspend local device for high availability'
   It will cause the other device in a HA pair to become Active.
   
    
   
   
4. On the suspended device in CLI run command "debug system ssh-key-reset high-availability"
   
   
   
   
5. After reboot, proceed with key exchange. RMA device will become functional again in HA pair. Export HA Key from RMA device and import it on the Active one.
   
   EXPORT HA KEY ON PREVIOUSLY SUSPENDED FIREWALL
   GUI: Device > Certificate Management > Certificates > Export HA key. Save to a local disk or network location.
   
   
   
   CLI: > scp export high-availability-key from HA-key-XXXXXX to user@server_ip:/directory
   
   IMPORT HA KEY ON SECOND FIREWALL
   GUI: Device > Certificate Management > Certificates > Import HA key.
   
   
   
   CLI: > scp import high-availability-key from user@server_ip:/directory/HA-key-XXXXXX
   
   
6. Repeat steps 3 to 5 for the old firewall in HA pair.
    
7. Suspend HA Passive firewall. Device > High Availability > Operational Commands > 'Suspend local device for high availability'
   
    
   
   
8. Enable HA encryption on the suspended device. Device > High Availability > HA Communication > HA1
   
   
   and Commit changes.
   
   
9. On the Active HA firewall enable HA encryption and Commit changes. Device > High Availability > HA Communication > HA1
   
   
   
   
10. Make suspended firewall functional again in HA pair. Device > High Availability > Operational Commands > 'Make local device functional for high availability'