- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
I lost SSH access to my PA-3020 passive firewall on mgmt. interface.. I can access it via GUI.
for Active Firewall, both SSH and GUI are OK.
I think it happened after I did fixing weak ciphers and keys on mgmt. interface. interface for SSH access.
I did the following procedure on both active/passive FW.
and I found the Palo recommended solution below, but I could not able to access the device console currently.
is there any way to fix the issue by remote?
- can we fix by enabling telnet and access the device?
- can we fix by rebooting passive device?
- can we fix by running the following commands?
> request high-availability sync-to-remote running-config (on Active)
> set ssh service-restart mgmt (on Passive)
The Important section of the KB you was following does kind of a bad job of calling it out, but you actually do need to ensure that you have active SSH sessions open to both devices while doing this procedure or you risk running into this sort of situation. It should also include, at least in my opinion, a warning that you should have easy access to the console interface on the device should something go wrong explicitly spelt out.
As for your current situation, part of the KB is running the config sync and restarting the ssh service on the passive node. If you for some reason lost access to the passive firewall during this process or didn't follow those two steps you end up in a situation like you have now. The fix for this is just finishing those steps and restart the ssh service through the console port.
Since you don't have easy access to the passive device outside of the GUI, you can still sync the config from the active firewall and wait a bit for that to complete (monitor from the 'Tasks' tab on the GUI on the passive) and simply issue the ssh service-restart mgmt command through the api. Remember that almost anything you can do on the CLI you can do through the XML API.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!