Accessing A New Palo Alto Firewall In The GCP

[kgsd2019]

Experts.,

We have a virtual Palo Alto firewall (BYOL) in the GCP and were able to change password using the initial access and the ppk file.

We provisioned one more VM firewall in same GCP setup, however this time we are unable to recreate the steps we had done earlier

After the instance is provisioned we have configured ssh key in GCP and from our machine using this command to access new firewall.

ssh -i file.ppk admin@Public IP

It is accepting a key and then it goes ahead and asks for the admin password which should not be the case.

This is not working and I am wondering where we are going wrong?

We tried deleting the firewall instance and re provisioned multiple time, but no luck, getting same error.

From PAN-OS® Release Notes 8.1. I found issue ID PAN-100686 which says that ‘An invalid public key is intermittently applied to the administrator account when deploying a VM-Series firewall in Google Cloud using the Google web interface.’

We are not sure if we are hitting this.

Any comments?

[kiwi]

Hi @kgsd2019 ,

To get confirmation on wether or not you're hitting a existing bug I'm afraid you'll need to reach out to support.

Maybe anyone else can shed some light here ?

Cheers,

-Kiwi.

[kgsd2019]

Thanks Kiwi for your prompt reply.

I am going to check with support for bug however just want to check with community if anyone else facing the same issue in GCP setup.

[kgsd2019 · Accepted solution]

Issue has been resolved by re-configuring GCP native firewall.

[Alex_Kamalov]

What was the rule name in GCP native firewall? Was it one of those implied rules? We're having exactly the same problem.

[Chris-Gapske]

the GCP integration is really stupid.  Why U can't just change the management password via console as the first step or have the script use a forced admin password change would be easy and get you up and running quick. This is horrible and slow. 

[Chris-Gapske]

Without details it should not be considered resolved.

[Chris-Gapske]

This problem is not resolved. It should also be noted It is stupid to not have GCP also set the Admin password.