-
タイトル
TPAM not successfully changing password on a PAN-OS (Palo Alto Network) firewall. -
説明
A PAN Superuser account is configured and is able to login successfully through both the UI and the CLI; the functional account on the PAN device is valid. However, the Password Reset fails to apply on the Pao Alto device but is still changed within TPAM.
The 'Test System' and 'Check Password' appear to be returning valid results. The output from 'Reset Password' returns:
"A timeout occurred waiting for a response from the system"
"An error occurred changing the password for accountname on systemname."
-
原因
The Pao Alto 'commit' command may take longer than the default 20 seconds -
対策
1. From From /tpam | Find the System in question | Details | Connection tab, increase the "Connection Timeout".
Running the 'commit' command manually (outside of TPAM) on the PAN device should provide an estimate of how long the Connection Timeout may need to be.
From 2,5,915 a "Reset Password" will use the timeout set in the "Password Change" profile, to change the timeout:1. From /tpam | Find the System in question | Details | Management tab | Note the "Password Change" profile in use.2. From /tpam | Profile Management | Select Password Change | Select the "Password Change" profle in use and "Change password timeout"