topic Re: CLI access to PA in General Topics

CLI access to PA

jdprovine — Thu, 13 Dec 2018 15:48:57 GMT

@reaper, @BPry @Mick_Ball

What could cause a superuser to not be able to ssh to the CLI of the PA?

Re: CLI access to PA

BPry — Thu, 13 Dec 2018 15:53:56 GMT

@jdprovine,

Do you get some sort of error message or does the device simply never respond?

Re: CLI access to PA

RobinClayton — Thu, 13 Dec 2018 15:54:12 GMT

Do you get the loign prompt?

Re: CLI access to PA

jdprovine — Thu, 13 Dec 2018 15:54:42 GMT

@BPry

Its simply never responds

Re: CLI access to PA

jdprovine — Thu, 13 Dec 2018 15:55:05 GMT

@RobinClayton

Nope no login prompt

Re: CLI access to PA

BPry — Thu, 13 Dec 2018 16:05:21 GMT

@jdprovine,

Look in the threat logs for ( id eq 31914 ) and see if the traffic is getting identified as a threat and droped. Ensure that your management profile wasn't altered to disable SSH access, or that it wasn't disabled on the management port itself. Ensure that if this traffic flows through the firewall it is actually allowed and isn't hitting the default interzone-default deny policy.

Does this only happen to one user, or is it anyone who attempts to access the device?

Re: CLI access to PA

RobinClayton — Thu, 13 Dec 2018 16:06:11 GMT

So not limited to super user,

Using the same IP as the HTTPS interface?

Device > Setup > Interface > management ( SSH enabled? )

Re: CLI access to PA

jdprovine — Thu, 13 Dec 2018 16:12:22 GMT

@BPry

I checked and nope not being dropped as a threat. Management interface is set to allow ssh access. I am not the one who cannot ssh, it is a user that was just elevated to superuser in the last week. I and others can ssh fine to both PA's. I don't see the user being blocked in the traffic monitor, in fact he is in the same zone as the PA.

Re: CLI access to PA

jdprovine — Thu, 13 Dec 2018 16:13:35 GMT

@RobinClayton

Only one user is having this issue and he is a superuser. Yes same IP as the HTTPS interface .

Device > Setup > Interface > management ( SSH enabled? ) - yes

Re: CLI access to PA

reaper — Thu, 13 Dec 2018 16:17:18 GMT

Has the user been able to log into the web interface ?

Re: CLI access to PA

RobinClayton — Thu, 13 Dec 2018 16:22:55 GMT

If there is no login prompt, is this not affecting all users from the same workstation?

"I don't see the user being blocked in the traffic monitor, in fact he is in the same zone as the PA."

Are they using the Dedicated managemetn interface? ( can they ping it? )

Is there any IP restrictions on the management interface?

Re: CLI access to PA

jdprovine — Thu, 13 Dec 2018 16:25:19 GMT

@reaper

Yes he is able to login to the web interface

Re: CLI access to PA

Mick_Ball — Thu, 13 Dec 2018 16:26:00 GMT

Hi @jdprovine'

perhaps go back a step, is ping enabled on management interface.

if it is and you can ping the interface, then see if the troubled user can also ping it.

Re: CLI access to PA

jdprovine — Thu, 13 Dec 2018 16:26:55 GMT

@RobinClayton

Everything is the same for him as it is for me, he is able to use the local superuser admin account and login fine

Re: CLI access to PA

jdprovine — Thu, 13 Dec 2018 16:28:32 GMT

@Mick_Ball

Yes ping is enabled, I will check if he can ping it

Re: CLI access to PA

Mick_Ball — Thu, 13 Dec 2018 16:28:45 GMT

oops,,, sorry all, just realised there are 2 pages to this , only read the first one, until now, my bad...

Re: CLI access to PA

RobinClayton — Thu, 13 Dec 2018 16:29:33 GMT

He is selecting "SSH" in his client I hope............. and nto a defalut telnet..

Re: CLI access to PA

jdprovine — Thu, 13 Dec 2018 16:29:48 GMT

@Mick_Ball

no problemoooo

Re: CLI access to PA

Mick_Ball — Thu, 13 Dec 2018 16:36:58 GMT

Windoze firewall..... ?

Re: CLI access to PA

jdprovine — Thu, 13 Dec 2018 16:37:43 GMT

@Mick_Ball

Nope its a mac