Scheduled Log Export doesn't accept new SSH host key

AnneB — Fri, 31 Jan 2014 17:52:22 GMT

Hi everyone,

today I reinstalled our syslog server which we use to archive the traffic logs of our PA-3020s (amongst some other things) and didn't import the old server's ssh host keys.

After updating the configuration for the Scheduled Log Export in the GUI I clicked the "Test SCP Server Connection" button and got the following message:

Even though it says...

... after confirmation, I keep getting the first message again and again when I try to test the SCP server connection.

Using the "delete user-file ssh-known-hosts user username all" command in the CLI also didn't solve the problem. On the other hand, doing a "scp export [...]" to the new syslog server via the CLI is working fine.

Has anyone of you been having the same issue and/or an idea what I could do to fix this?

Thanks in advance and best regards!

- Anne

PS: We are currently running PAN-OS 5.0.10

Re: Scheduled Log Export doesn't accept new SSH host key

AnneB — Mon, 03 Feb 2014 08:21:47 GMT

Okay, I think I somehow solved the issue. This is what I did:

Updated PAN-OS 5.0.10 to PAN-OS 5.0.11. After this, the problem was still there, so I'm just including this step here for the sake of completeness.
In the dialog where you add the Scheduled Log Export job I replaced the hostname of our syslog server with its IP address.
I got a similar message like the one above, telling me that the host key changed and "SOMEONE MAY BE DOING SOMETHING NASTY" (sorry, don't have a screenshot) and asking if I wanted to accept the new key.
After confirmation, the test of the SCP server connection started working.
Then I replaced the IP adress with the hostname again and the export still worked!

topic Re: Scheduled Log Export doesn't accept new SSH host key in General Topics

Scheduled Log Export doesn't accept new SSH host key

Re: Scheduled Log Export doesn't accept new SSH host key