CLI access to PA

[jdprovine]

@reaper, @BPry @Mick_Ball

What could cause a superuser to not be able to ssh to the CLI of the PA?

[BPry]

@jdprovine,

Do you get some sort of error message or does the device simply never respond? 

[RobinClayton]

Do you get the loign prompt?

[jdprovine]

@BPry

Its simply never responds

[jdprovine]

@RobinClayton

Nope no login prompt

[BPry]

@jdprovine,

Look in the threat logs for ( id eq 31914 ) and see if the traffic is getting identified as a threat and droped. Ensure that your management profile wasn't altered to disable SSH access, or that it wasn't disabled on the management port itself. Ensure that if this traffic flows through the firewall it is actually allowed and isn't hitting the default interzone-default deny policy. 

Does this only happen to one user, or is it anyone who attempts to access the device?

[RobinClayton]

So not limited to super user,

Using the same IP as the HTTPS interface?

Device > Setup > Interface > management ( SSH enabled? )

[jdprovine]

@BPry

I checked and nope not being dropped as a threat. Management interface is set to allow ssh access. I am not the one who cannot ssh, it is a  user that was just elevated to superuser in the last week. I and others can ssh fine to both PA's. I don't see the user being blocked in the traffic monitor, in fact he is in the same zone as the PA.

[jdprovine]

@RobinClayton

Only one user is having this issue and he is a superuser. Yes same IP as the HTTPS interface .

Device > Setup > Interface > management ( SSH enabled? ) - yes

[reaper]

Has the user been able to log into the web interface ?

[RobinClayton]

If there is no login prompt, is this not affecting all users from the same workstation?

"I don't see the user being blocked in the traffic monitor, in fact he is in the same zone as the PA."

Are they using the Dedicated managemetn interface? ( can they ping it? )

Is there any IP restrictions on the management interface?

[jdprovine]

@reaper

Yes he is able to login to the web interface

[Mick_Ball]

Hi @jdprovine'

perhaps go back a step, is ping enabled on management interface.

if it is and you can ping the interface, then see if the troubled user can also ping it. 

[jdprovine]

@RobinClayton

Everything is the same for him as it is for me, he is able to use the local superuser admin account and login fine

[jdprovine]

@Mick_Ball

Yes ping is enabled, I will check if he can ping it