topic Re: Screwed up management IP in General Topics

Screwed up management IP

Daniel_Stoltz — Fri, 02 Jun 2017 18:35:48 GMT

So I was configuring a new PA 200 using an XML file and I screwed up the management IP. So I logged into what I thought was my new device, but was an existing already operational device and changed only it's management IP without changing default gateway and other information. So now the device is inaccessable remotely. Is there a way to SSH via HA, because that is still reporting up, or via GUI to get in and change that management IP back to what it needs to be, or am I stuck going onsite to console into the device.

PanOS on the box is 7.0.12.

Re: Screwed up management IP

SuryaR — Fri, 02 Jun 2017 19:11:26 GMT

What kind of interface management profile you have on the device.

If you allow HTTPS and SSH on your data-interfaces. you should still be able to access it via E1/1,2,3,4.....

Re: Screwed up management IP

Brandon_Wertz — Fri, 02 Jun 2017 19:31:28 GMT

I don't think there's a way to get into the appliance via HA, but perhaps you can get into the appliance via a physical interface if you had a management profile, with the appropriate access assigned to it?

Re: Screwed up management IP

Daniel_Stoltz — Fri, 02 Jun 2017 21:16:44 GMT

Unfortunately, it won't let me in via SSH on any other IPs. Console it is. Thanks for the help everyone.

Re: Screwed up management IP

gwesson — Fri, 02 Jun 2017 21:44:40 GMT

If your HA peer is up and reachable, you could add a management profile to one of the DP interfaces as suggested earlier to the peer device and commit that change. Config sync would go over HA1 or HA1-backup (if configured). Then you can SSH into the DP interface without having to go to the device physically if there's no console server.

Re: Screwed up management IP

pulukas — Sat, 03 Jun 2017 00:21:28 GMT

Your other option is to hop on a switch or router in the same subnet as the mgmt ip address and do the ssh from this device.

Then the communication is all over the local vlan and the missing default route will not matter.