topic Re: Accessing A New Palo Alto Firewall In The GCP in General Topics

Accessing A New Palo Alto Firewall In The GCP

kgsd2019 — Thu, 30 Jan 2020 08:30:40 GMT

Experts.,

We have a virtual Palo Alto firewall (BYOL) in the GCP and were able to change password using the initial access and the ppk file.

We provisioned one more VM firewall in same GCP setup, however this time we are unable to recreate the steps we had done earlier

After the instance is provisioned we have configured ssh key in GCP and from our machine using this command to access new firewall.

ssh -i file.ppk admin@Public IP

It is accepting a key and then it goes ahead and asks for the admin password which should not be the case.

This is not working and I am wondering where we are going wrong?

We tried deleting the firewall instance and re provisioned multiple time, but no luck, getting same error.

From PAN-OS® Release Notes 8.1. I found issue ID PAN-100686 which says that ‘An invalid public key is intermittently applied to the administrator account when deploying a VM-Series firewall in Google Cloud using the Google web interface.’

We are not sure if we are hitting this.

Any comments?

Re: Accessing A New Palo Alto Firewall In The GCP

kiwi — Thu, 30 Jan 2020 14:19:53 GMT

Hi @kgsd2019 ,

To get confirmation on wether or not you're hitting a existing bug I'm afraid you'll need to reach out to support.

Maybe anyone else can shed some light here ?

Cheers,

-Kiwi.

Re: Accessing A New Palo Alto Firewall In The GCP

kgsd2019 — Mon, 03 Feb 2020 07:52:15 GMT

Thanks Kiwi for your prompt reply.

I am going to check with support for bug however just want to check with community if anyone else facing the same issue in GCP setup.

Re: Accessing A New Palo Alto Firewall In The GCP

kgsd2019 — Wed, 12 Feb 2020 10:29:33 GMT

Issue has been resolved by re-configuring GCP native firewall.

Re: Accessing A New Palo Alto Firewall In The GCP

Alex_Kamalov — Tue, 15 Mar 2022 17:43:07 GMT

What was the rule name in GCP native firewall? Was it one of those implied rules? We're having exactly the same problem.

Re: Accessing A New Palo Alto Firewall In The GCP

Chris-Gapske — Mon, 17 Apr 2023 16:56:05 GMT

the GCP integration is really stupid. Why U can't just change the management password via console as the first step or have the script use a forced admin password change would be easy and get you up and running quick. This is horrible and slow.

Re: Accessing A New Palo Alto Firewall In The GCP

Chris-Gapske — Mon, 17 Apr 2023 17:22:09 GMT

Without details it should not be considered resolved.

Re: Accessing A New Palo Alto Firewall In The GCP

Chris-Gapske — Mon, 17 Apr 2023 17:22:42 GMT

This problem is not resolved. It should also be noted It is stupid to not have GCP also set the Admin password.