topic Re: Delay in SSH prompt in General Topics

Delay in SSH prompt

dsulli99 — Mon, 07 May 2012 15:21:36 GMT

Hi, All,

I have a hopefully quick question regarding my Palo Alto 5050 firewall pair; whenever I go to log in via SSH, I get a delay of approximately 5-10 seconds before I am actually prompted for a password. Is this normal? This is more of a nuisance than anything causing a problem, however it is begining to bother me because I am logging into these devices somewhat frequently. I seem to remember that when I first set these up, that I would get prompted immediately. I took a quick look at the logs and I don't see anything that would suggest why a delay is being caused in my being prompted for a password. Has anybody seen this symptom before?

Thank-you so much,

Dan Sullivan

Re: Delay in SSH prompt

mharding — Mon, 07 May 2012 16:17:37 GMT

I see a delay on my 2050 when the management process is running high.

Re: Delay in SSH prompt

ppatel — Mon, 07 May 2012 20:47:09 GMT

Hi Dan,

Yes, it can be high management causing the prompt to delay.

Check the output for the following CLI comand:-

>show system resources follow

Look for the swap usage and also the the following processes:-

mgmtsrv

devsrv

Regards,

Parth

Re: Delay in SSH prompt

mikand — Tue, 08 May 2012 06:56:30 GMT

The delay of 5-10 seconds before you can login is most likely caused by incorrect dns settings on your server and/or lack of reverse lookup (PTR-record) for the ip address your client uses.

So to fix this:

1) Verify that the ip your client uses (or rather the ip your PA box will see in case you have NAT on the road) have a PTR-record in your DNS-servers.

dig -x <ipaddress>

or if you wish to do this manually (where the ip is A.B.C.D)

dig D.C.B.A.in-addr.arpa

2) Verify that your PA box uses your DNS servers in its settings.

3) Verify that your PA box can reach your DNS servers (and if not fix with service route configuration - not uncommon that you need to change dns traffic from mgmtplane to use dataplane rather than mgmtinterface).

Re: Delay in SSH prompt

dsulli99 — Tue, 08 May 2012 14:56:48 GMT

Hi,

This is what I needed; the problem was that I had entered an explicity deny any any policy at the end so that all dropped packets would be logged; I needed to add an additional policy that allowed all traffic from 'outside' to 'outside' so that the firewall could resolve DNS properly.

Thank-you,

Dan Sullivan