SSH decrypt and not decrypt

[RonnieAxelsson]

Hi.

I have an ERP server on the inside which must be access from supplier via SSH. Trying both using proxy and no decrypt but always getting Aged out in traffic monitor. 

I don't have access to the ERP system but I got the routing printed and it looks ok. 

Any ideas what would be causing aged out? Firewall in the *nix machine? 

(Trying to get access to the *nix machine and have a look)

Best regards

/Ronnie

[pulukas]

Sounds like a good theory that the issue is on the server since you can see the session is permitted on the PA.

You could also do a packet capture of the login attempt, this might give you more specific information on where the process is failing.

https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/monitor/monitor-packet-c...

[Harshit]

in addition to what @pulukas said,

you can run tcpdump on the *nix machine as well.

SInce it is hosted inside, i am assuming you have made sure of NAT to be working correctly.

~HTH

[OtakarKlier]

Hello,

Is this over a VPN tunnel? Do the traceroutes look ok, if allowed? When you view the traffic logs, where is it getting dropped as opposed to how your rule is written to allow the traffic.

Please advise,

[RonnieAxelsson]

Hi

Got access to the *nix machine. 

Guess what, there was an firewall implmeneted (that the supplier didn't know about)

So when this was resolved everything works as expeceted. 

thanks for all the replies. 

Best regards

/Ronnie