topic Re: cannot connect to VM-Series Next-Generation Firewall in VM-Series in the Public Cloud

cannot connect to VM-Series Next-Generation Firewall

careem785 — Wed, 16 Sep 2020 13:43:53 GMT

cannot connect to VM-Series Next-Generation Firewall (both BYOL and Bundle1)

getting connection refused for both SSH and HTTPS

tried with public ip and private ip

Re: cannot connect to VM-Series Next-Generation Firewall

tostern — Wed, 16 Sep 2020 13:49:23 GMT

Hi @careem785

where do you deploy it? Azure/AWS/GCP

Regards,

Torsten

Re: cannot connect to VM-Series Next-Generation Firewall

JoergSchuetter — Wed, 16 Sep 2020 13:49:24 GMT

Hello @careem785

Are you talking about a setup in Azure? If so, please check the NSG (Network Security Group) for the firewall (NIC and VNET).

Re: cannot connect to VM-Series Next-Generation Firewall

tostern — Wed, 16 Sep 2020 13:52:42 GMT

when you talk about Azure then create please a NSG as shown below and attach it to the NIC.

Then when you using a Public IP (Standard) then is there a implicite deny when you not attach any NSG to it

Re: cannot connect to VM-Series Next-Generation Firewall

careem785 — Wed, 16 Sep 2020 13:53:31 GMT

its in AWS and security group rules are fine , i can ping to the device but SSH and HTTPS not working

Re: cannot connect to VM-Series Next-Generation Firewall

tostern — Wed, 16 Sep 2020 13:56:29 GMT

Hi @careem785

are you using the correct ssh key pair? Look at Step 4 in that document

https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/deploy-the-vm-series-firewall-on-aws/launch-the-vm-series-firewall-on-aws.html#ide07b93a2-ccb3-4c69-95fe-96e3328b8514

Then AWS works with ssh key pairs and not with username/password

Regards,

Torsten

Re: cannot connect to VM-Series Next-Generation Firewall

careem785 — Wed, 16 Sep 2020 13:58:56 GMT

key pair is fine , i am getting "connection refused" error message

Re: cannot connect to VM-Series Next-Generation Firewall

tostern — Wed, 16 Sep 2020 14:09:35 GMT

did you swap the management interface?

Re: cannot connect to VM-Series Next-Generation Firewall

careem785 — Wed, 16 Sep 2020 14:27:45 GMT

no , how to do that?

Re: cannot connect to VM-Series Next-Generation Firewall

tostern — Wed, 16 Sep 2020 14:29:17 GMT

you can't doing it without having cli access to firewall. Please double check taht you are using the right interface and not that you try to connect to the untrust interface.

Re: cannot connect to VM-Series Next-Generation Firewall

careem785 — Wed, 16 Sep 2020 14:31:59 GMT

i am launching with only one interface and tried to access,

Re: cannot connect to VM-Series Next-Generation Firewall

careem785 — Wed, 16 Sep 2020 15:15:14 GMT

i am launching with only one interface and tried to access,

Re: cannot connect to VM-Series Next-Generation Firewall

tostern — Wed, 16 Sep 2020 15:34:29 GMT

It is really hard to say what is going wrong here without seeing it but i still think that something is wrong with Security Rules, routing, ssh key pair or Internet Gateway.

Please review everything against our official guides.

Regards,

Torsten

Re: cannot connect to VM-Series Next-Generation Firewall

careem785 — Thu, 17 Sep 2020 00:54:03 GMT

how can i open a support account , without login in to the firewall , because the support account asking serial no

Re: cannot connect to VM-Series Next-Generation Firewall

tostern — Thu, 17 Sep 2020 07:59:13 GMT

Hi,

i recommend that you destroy the environment and redeploy it and following this guide https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/deploy-the-vm-series-firewall-on-aws/launch-the-vm-series-firewall-on-aws.html#ide07b93a2-ccb3-4c69-95fe-96e3328b8514

or use the following script https://github.com/wwce/aws-cft/tree/master/AWS-Ref-Architecture