Can't access management console

[bobvaal]

I made a big mistake and not sure how to correct it.  We have a Palo Alto Firewall.  I wanted to white list an IP address so my PCI Scans would not fail.  I found an article but it seems it lead me a totally different direction.  It had me put the IP in the Trusted IP list on the Management Interface Policy.  Now I can't login or even ping the PA management IP.  Is there way I can redeem myself and get the IP out of the Trusted IP list.  Would I have to be at the physical device and via the console port?

[bafergel]

Do you have physical access to the firewall? You should still be able to console in.

I believe this article is referencing your issue. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClLqCAK

In regards to whitelisting for PCI scans, you may be wanting to look at an exclusion for the zone protection profile. 

[TomYoung]

Hi @bobvaal ,

Can you RDP to the IP address that you put in the Permitted IP Addresses and then HTTPS to the firewall from it?

Thanks,

Tom

[BPry]

@bobvaal,

Assuming that you don't otherwise have an interface management profile configured to allow management access of any kind through a data plane interface, the only way to access this unit is now from the IP address that you put into the permitted-ip list or through the console cable. 

The one thing that you potentially can do depending on the site is simply give yourself the IP address that you've permitted access. This can generally be accomplished through a NAT setup on a L3 capable switch or router that may exist on the site. Depending on the equipment you have available at the site outside of the firewall, it's a possibility for most enterprise environments.