Unable to SSH to Passive firewall, GUI OK

[zinkt101]

hello everyone,

I lost SSH access to my PA-3020 passive firewall on mgmt. interface.. I can access it via GUI.

for Active Firewall, both SSH and GUI are OK.

I think it happened after I did fixing weak ciphers and keys on mgmt. interface. interface for SSH access.

I did the following procedure  on both active/passive FW.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PN5bCAG

and I found the Palo recommended solution below, but I could not able to access the device console currently.

• Solution: 
  1. On secondary FW, turn off SSH from the WebUI.
  2. Log in through the console, first delete the existing configuration and then make the cipher changes again.
  3. Restart the service "set ssh service-restart mgmt"
  4. Then turned on SSH from the WebUI Or You can change the SSH related configuration on both FW simultaneously and restart SSH service on management together. 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAsiCAG

is there any way to fix the issue by remote? 

- can we fix by enabling telnet and access the device?

- can we fix by rebooting passive device?

- can we fix by running the following commands?

> request high-availability sync-to-remote running-config (on Active)
> set ssh service-restart mgmt (on Passive)

Please suggest. Thank you.

[BPry]

@zinkt101,

The Important section of the KB you was following does kind of a bad job of calling it out, but you actually do need to ensure that you have active SSH sessions open to both devices while doing this procedure or you risk running into this sort of situation. It should also include, at least in my opinion, a warning that you should have easy access to the console interface on the device should something go wrong explicitly spelt out. 

As for your current situation, part of the KB is running the config sync and restarting the ssh service on the passive node. If you for some reason lost access to the passive firewall during this process or didn't follow those two steps you end up in a situation like you have now. The fix for this is just finishing those steps and restart the ssh service through the console port.

Since you don't have easy access to the passive device outside of the GUI, you can still sync the config from the active firewall and wait a bit for that to complete (monitor from the 'Tasks' tab on the GUI on the passive) and simply issue the ssh service-restart mgmt command through the api. Remember that almost anything you can do on the CLI you can do through the XML API.

/api/?type=op&cmd=<set><ssh><service-restart><mgmt></mgmt></service-restart></ssh></set>

[zinkt101]

thank you for your reply and I will try to restart through the api.