topic Palo Alto Mgmt Port Issue in General Topics

Palo Alto Mgmt Port Issue

Lakshitha — Mon, 12 Nov 2018 15:02:34 GMT

Dear Friends,

We are facing a issue that currently we are unable to console to firewall device. But traffic is passing through active firewall. Status is HA1 backup= Down

Please advice

Thanks,

Lakshitha

Re: Palo Alto Mgmt Port Issue

BPry — Mon, 12 Nov 2018 16:01:06 GMT

@Lakshitha,

You'll have to provide a bit more info then that. Is the management interface your HA1 backup interface? Have you tried directly connecting to the Mgmt interface and verifying that the interface itself functions as it should?

Re: Palo Alto Mgmt Port Issue

Lakshitha — Mon, 12 Nov 2018 16:40:07 GMT

Hi,

Yes you r correct. Tried but mgmt interface not loading even Console port also not connecting. If we reboot it it may works. But I need to know exact resion. Please advice

Thanks

Lakshitha

Re: Palo Alto Mgmt Port Issue

BPry — Mon, 12 Nov 2018 18:54:29 GMT

@Lakshitha,

At that point you really need to reload the box and see if you gain any sort of output from the firewall again. You can't troubleshoot this if you don't have any way to actually look at the box.

Re: Palo Alto Mgmt Port Issue

Raido_Rattameister — Mon, 12 Nov 2018 19:17:58 GMT

@Lakshitha if neither console or mgmt interface works then check if you have configured interface management profile to any of network interfaces to allow fw management.

If yes then during offhours send active firewall to reboot and log into problematic firewall through dataplane interface.

If not then reboot problematic firewall and see if connectivity restores.

Re: Palo Alto Mgmt Port Issue

Lakshitha — Tue, 13 Nov 2018 15:08:36 GMT

Dear Friends,

Thnaks everyone. It was sort out. Problem was an ip address on Mgmt allowed ip list. I deleted it using

Configure

delete deviceconfig system permitted-ip <subnet to be removed>

But my question is Why Console port also does not work ?

Thanks,

Lakshitha.

Re: Palo Alto Mgmt Port Issue

BPry — Tue, 13 Nov 2018 21:00:24 GMT

@Lakshitha,

You can actually turn off the MGMT port if you've enabled FIPS mode or CCEAL4. That's the only time I would expect the console port to be non-functional short of a malfunction of the port itself.