Panorama scheduled config-export failure with 20 character SCP password.

ECPP — Fri, 16 Feb 2018 19:53:31 GMT

I noticed my Scheduled config-export backups were not working. At some point they were working file. Upon Further troubleshooting I found that the Panorama scheduled config export was failing because the password was 20 characters long. Upon changing to a 15 character password for the account the exports were successful. This appears to be an undocumented bug where this is a very short limit to the length of password usable by Panorama.

Re: Panorama scheduled config-export failure with 20 character SCP password.

BPry — Fri, 16 Feb 2018 21:04:49 GMT

@ECPP,

It would be helpful when reporting a possible issue if the Panorama version number was presented 🙂

*Edit*

This actually looks to be expected.

Cause
When the Palo Alto Networks firewall tries to connect to the SCP server, it encrypts the password and the data can be at most 63 characters. This value doesn't reflect the actual number of characters in unencrypted form entered in the password field.

 

The maximum length of the password is 15. If the password exceeds 15 characters, then the test SCP connection will throw the error.

 

Resolution
Reduce the length of the password to 15 or less.

https://live.paloaltonetworks.com/t5/Management-Articles/Password-limit-for-Scheduled-config-Export/ta-p/56661

topic Panorama scheduled config-export failure with 20 character SCP password. in General Topics

Panorama scheduled config-export failure with 20 character SCP password.

Re: Panorama scheduled config-export failure with 20 character SCP password.