Unable to SSH to Passive firewall, GUI OK

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Unable to SSH to Passive firewall, GUI OK

L1 Bithead

hello everyone,

I lost SSH access to my PA-3020 passive firewall on mgmt. interface.. I can access it via GUI.

for Active Firewall, both SSH and GUI are OK.

I think it happened after I did fixing weak ciphers and keys on mgmt. interface. interface for SSH access.

I did the following procedure  on both active/passive FW.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PN5bCAG

 

and I found the Palo recommended solution below, but I could not able to access the device console currently.

  • Solution: 
    1. On secondary FW, turn off SSH from the WebUI.
    2. Log in through the console, first delete the existing configuration and then make the cipher changes again.
    3. Restart the service "set ssh service-restart mgmt"
    4. Then turned on SSH from the WebUI Or You can change the SSH related configuration on both FW simultaneously and restart SSH service on management together. 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAsiCAG

 

 

is there any way to fix the issue by remote? 

- can we fix by enabling telnet and access the device?

- can we fix by rebooting passive device?

- can we fix by running the following commands?

> request high-availability sync-to-remote running-config (on Active)
> set ssh service-restart mgmt (on Passive)

 
Please suggest. Thank you.
2 REPLIES 2

Cyber Elite
Cyber Elite

@zinkt101,

The Important section of the KB you was following does kind of a bad job of calling it out, but you actually do need to ensure that you have active SSH sessions open to both devices while doing this procedure or you risk running into this sort of situation. It should also include, at least in my opinion, a warning that you should have easy access to the console interface on the device should something go wrong explicitly spelt out. 

As for your current situation, part of the KB is running the config sync and restarting the ssh service on the passive node. If you for some reason lost access to the passive firewall during this process or didn't follow those two steps you end up in a situation like you have now. The fix for this is just finishing those steps and restart the ssh service through the console port.

 

Since you don't have easy access to the passive device outside of the GUI, you can still sync the config from the active firewall and wait a bit for that to complete (monitor from the 'Tasks' tab on the GUI on the passive) and simply issue the ssh service-restart mgmt command through the api. Remember that almost anything you can do on the CLI you can do through the XML API.

/api/?type=op&cmd=<set><ssh><service-restart><mgmt></mgmt></service-restart></ssh></set>

 

thank you for your reply and I will try to restart through the api.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!