topic SSH decrypt and not decrypt in General Topics

SSH decrypt and not decrypt

RonnieAxelsson — Mon, 30 Apr 2018 08:02:44 GMT

Hi.

I have an ERP server on the inside which must be access from supplier via SSH. Trying both using proxy and no decrypt but always getting Aged out in traffic monitor.

I don't have access to the ERP system but I got the routing printed and it looks ok.

Any ideas what would be causing aged out? Firewall in the *nix machine?

(Trying to get access to the *nix machine and have a look)

Best regards

/Ronnie

Re: SSH decrypt and not decrypt

pulukas — Mon, 30 Apr 2018 10:03:04 GMT

Sounds like a good theory that the issue is on the server since you can see the session is permitted on the PA.

You could also do a packet capture of the login attempt, this might give you more specific information on where the process is failing.

https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/monitor/monitor-packet-capture

Re: SSH decrypt and not decrypt

Harshit — Mon, 30 Apr 2018 20:47:21 GMT

in addition to what @pulukas said,

you can run tcpdump on the *nix machine as well.

SInce it is hosted inside, i am assuming you have made sure of NAT to be working correctly.

~HTH

Re: SSH decrypt and not decrypt

OtakarKlier — Mon, 30 Apr 2018 22:09:57 GMT

Hello,

Is this over a VPN tunnel? Do the traceroutes look ok, if allowed? When you view the traffic logs, where is it getting dropped as opposed to how your rule is written to allow the traffic.

Please advise,

Re: SSH decrypt and not decrypt

RonnieAxelsson — Wed, 02 May 2018 09:33:29 GMT

Got access to the *nix machine.

Guess what, there was an firewall implmeneted (that the supplier didn't know about)

So when this was resolved everything works as expeceted.

thanks for all the replies.

Best regards

/Ronnie