Can't access management console

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Can't access management console

L0 Member

I made a big mistake and not sure how to correct it.  We have a Palo Alto Firewall.  I wanted to white list an IP address so my PCI Scans would not fail.  I found an article but it seems it lead me a totally different direction.  It had me put the IP in the Trusted IP list on the Management Interface Policy.  Now I can't login or even ping the PA management IP.  Is there way I can redeem myself and get the IP out of the Trusted IP list.  Would I have to be at the physical device and via the console port?

Bob Vaal
3 REPLIES 3

L2 Linker

Do you have physical access to the firewall? You should still be able to console in.

 

I believe this article is referencing your issue. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClLqCAK

 

In regards to whitelisting for PCI scans, you may be wanting to look at an exclusion for the zone protection profile. 

bafergel_0-1631652609287.png

 

Network Administrator

Cyber Elite
Cyber Elite

Hi @bobvaal ,

 

Can you RDP to the IP address that you put in the Permitted IP Addresses and then HTTPS to the firewall from it?

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Cyber Elite
Cyber Elite

@bobvaal,

Assuming that you don't otherwise have an interface management profile configured to allow management access of any kind through a data plane interface, the only way to access this unit is now from the IP address that you put into the permitted-ip list or through the console cable. 

 

The one thing that you potentially can do depending on the site is simply give yourself the IP address that you've permitted access. This can generally be accomplished through a NAT setup on a L3 capable switch or router that may exist on the site. Depending on the equipment you have available at the site outside of the firewall, it's a possibility for most enterprise environments. 

  • 3159 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!