topic Re: Unable to take passive firewall access. in Next-Generation Firewall Discussions

Unable to take passive firewall access.

FCI — Sat, 05 Nov 2022 05:19:50 GMT

We tried changing the cable, switchport and VLAN and also connected the Management Interface directly to a laptop. There was no SSH or HTTPS access possible

We also tried to restart the Management and Device Server and other related processes on the FW. There was no change in the access.

We uploaded TSF to a new case for further investigation.

We could, however, reach the peer IP and few other IPs in the Management subnet

We collected TCPDump for port 443 and 22 while trying to access the FW using GUI and CLI. We could only find Syn Packets sent to the Firewall and no Return traffic

Re: Unable to take passive firewall access.

Metgatz — Sat, 05 Nov 2022 05:38:52 GMT

Hello @FCI

By these coincidences, will you have IP Allow enabled at the MGT config interface level, which may be restricting access?

Is Ping, SSH, HTTPS enabled in the MGT config? Did you try (Of course only Temporary, for security ONLY temporary) enable Telnet in the MGT interface and try?

Does it respond to ping? Another thing, you have tried, by CLI, enabling a connection through one of the Data Plane interfaces, one of your routed interfaces or configuring a routed interface, and adding a management profile to be able to arrive, also trying directly connected.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGdCAK

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkVCAS

Best regards

Re: Unable to take passive firewall access.

FCI — Sat, 05 Nov 2022 05:44:27 GMT

Hello Metgatz, Thanks for your reply,

we are unable to ping, https and SSH, we connected laptop to management port and for laptop its pinging, same port is not pinging to firewall.

Re: Unable to take passive firewall access.

Metgatz — Sat, 05 Nov 2022 05:52:19 GMT

H @FCI i, did you check what I told you? If you have configured permited IP ?
If so, remove or place the network segment of the IP of the laptop, that is from the same segment of the IP of the MGT, the IP that you place in your LAPTOP.

Also check if something happens at the level of Duplex and speed of the MGT interface, so that you try to force.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClMVCA0

Best regards