I made a big mistake and not sure how to correct it. We have a Palo Alto Firewall. I wanted to white list an IP address so my PCI Scans would not fail. I found an article but it seems it lead me a totally different direction. It had me put the IP in the Trusted IP list on the Management Interface Policy. Now I can't login or even ping the PA management IP. Is there way I can redeem myself and get the IP out of the Trusted IP list. Would I have to be at the physical device and via the console port?
Do you have physical access to the firewall? You should still be able to console in.
I believe this article is referencing your issue. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClLqCAK
In regards to whitelisting for PCI scans, you may be wanting to look at an exclusion for the zone protection profile.
Assuming that you don't otherwise have an interface management profile configured to allow management access of any kind through a data plane interface, the only way to access this unit is now from the IP address that you put into the permitted-ip list or through the console cable.
The one thing that you potentially can do depending on the site is simply give yourself the IP address that you've permitted access. This can generally be accomplished through a NAT setup on a L3 capable switch or router that may exist on the site. Depending on the equipment you have available at the site outside of the firewall, it's a possibility for most enterprise environments.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!