Request for Assistance: PA-850 Recovery Boot and Support Account Registration

[admin]

I am writing to request urgent assistance with a Palo Alto PA-850 device in our possession. The device details are as follows:

• Model: PA-850

• Serial: ******

• P/N: ***

Issue summary:

• The device’s SSD has failed and I have replaced it with a new blank 240GB SSD.

• I am unable to boot into maintenance mode and cannot proceed with recovery.

• When attempting to register the device on the Customer Support Portal using our Support Portal account, I receive the following error: “Device and customer codes do not match a Support Account. Please contact a Super User to send you a registration link for the appropriate Support Account.”

• We do not have access to the previous administrator’s account or purchase documentation; the former administrator has left the company and the records are no longer available.

Requested assistance: Please help us with one of the following options so we can restore the device to operation:

1. Provide an Authorization Code, Entitlement ID, or Sales Order ID so we can register the device to our Support Account; or

2. Register the device on our behalf to the appropriate Support Account; or

3. Advise on acceptable proof of ownership we can provide (for example, photos of the device front and rear showing serial and part numbers) and the process to transfer or register the device; or

4. Provide a link to download the official USB Recovery image or Recovery Boot image for the PA-850 so we can reinstall the system on the new SSD.

Additional information:

• We can provide clear photographs of the device (front and back) showing the serial number and part number upon request.

• We currently do not have any purchase invoices, contracts, or entitlement documentation.

Please let us know the next steps and any documentation you require to verify ownership and enable registration or recovery. We appreciate your prompt assistance as we need to bring this device back into service.

Thank you for your support.

Error Cli:

    Welcome to the PanOS Bootloader.

U-Boot 11.0.0.0-70 (Build time: Nov 16 2023 - 17:39:43)

Octeon unique ID: 03000c01047ca59e0049
Not all cores came out of reset on node 0
N0.LMC0 Configuration Completed: 16384 MB
QLM 2: SGMII
QLM 3: XFI
QLM 4: SATA
DLM 5: SGMII
SATA0: available
SATA1: not available
SATA BIST STATUS = 0x0
MILLENNIUM board revision major:1, minor:7, serial #: 011***HIDEN***
OCTEON CN7240-AAP pass 1.3, Core clock: 1500 MHz, IO clock: 1000 MHz, DDR clock: 800 MHz (1600 Mhz DDR)
Base DRAM address used by u-boot: 0x40f000000, size: 0x1000000
DRAM: 16 GiB
Clearing DRAM...... done
Using default environment

Flash: 64 MiB
WARNING: Failed to get lmac fdt node for -100
WARNING: Failed to get lmac fdt node for -101
0:PCIe: Port 0 in endpoint mode.
0:PCIe: Port 0 in endpoint mode.
0:PCIe: Port 0 in endpoint mode.
0:PCIe: Port 0 in endpoint mode.
0:PCIe: Port 0 in endpoint mode.
PCIE0: Link requested a retry, but hit the max retries
0:PCIe: Port 1 is unknown, skipping.
0:PCIe: Port 1 is unknown, skipping.
0:PCIe: Port 1 is unknown, skipping.
0:PCIe: Port 1 is unknown, skipping.
0:PCIe: Port 1 is unknown, skipping.
PCIE1: Link requested a retry, but hit the max retries
0:PCIe: Port 2 is unknown, skipping.
0:PCIe: Port 2 is unknown, skipping.
0:PCIe: Port 2 is unknown, skipping.
0:PCIe: Port 2 is unknown, skipping.
0:PCIe: Port 2 is unknown, skipping.
PCIE2: Link requested a retry, but hit the max retries
0:PCIe: Port 3 is unknown, skipping.
0:PCIe: Port 3 is unknown, skipping.
0:PCIe: Port 3 is unknown, skipping.
0:PCIe: Port 3 is unknown, skipping.
0:PCIe: Port 3 is unknown, skipping.
PCIE3: Link requested a retry, but hit the max retries
SATA#0
Model: ELSKY 240GB Firm: T1155A0 Ser#: 20ZYC***HIDEN***
            Type: Hard Disk
            Capacity: 244121.8 MB = 238.4 GB (48269680 x 512)
Net:   mdio-octeon0:18 is connected to octmgmt0.  Reconnecting to octeth0
mdio-octeon0:17 is connected to octmgmt1.  Reconnecting to octeth1
octmgmt0 [PRIME], octmgmt1, octeth0, octeth1, octeth2, octeth3, octeth4, octeth5, octeth6, octeth7, octeth8, octeth9
** Invalid partition 6 **
** Bad partition - sata 0:6 **
** Invalid partition 6 **
** Bad partition - sata 0:6 **
** Invalid partition 2 **
** Bad partition - sata 0:2 **
** Invalid partition 3 **
** Bad partition - sata 0:3 **
Type the command 'usb start' to scan for USB storage devices.




        Autoboot to default partition in 5 seconds.
        Enter 'maint' to boot to maint partition.

Entry: maint

Booting to maint mode.

** Invalid partition 6 **
** Bad partition - sata 0:6 **
** Invalid partition 2 **
** Bad partition - sata 0:2 **
** Invalid partition 3 **
** Bad partition - sata 0:3 **
** Invalid partition 1 **
## No elf image at address 0x20000000
Millennium (mp)# #

[kiwi]

Hi @admin ,

It’s a classic orphaned device scenario where the technical knowledge and the administrative keys both left with the previous admin.

If the original Super User is gone and no one else in your company has access to the Customer Support Portal (CSP) account you'll need to recover the access because the device is locked to an account you cannot prove you own.

If your IT team can recreate the former admin's email address as an alias or a shared mailbox, you can simply go to the CSP login, click "Forgot Password," and reset their account yourself. Once in, you can promote your own email to a Super User and take full control.

f the email alias isn't an option, you can use the Palo Alto Networks Login Assistance page to creates an administrative ticket for Palo Alto to verify your account.

Contacting a local sales representative or the reseller partner you originally purchased from is a valid option. If you cannot reach a Super User because they have left the company, these are the primary human-led paths to help verify your identity and restore access to your account.

Alternatively you could call support directly and open an Administrative Case for account recovery or to have a new Super User assigned.

Hope this helps,

[reaper]

you can't recover a failed disk in a device by simply putting in a new disk, it needs to be a disk provisioned with the appropriate PAN-OS image provided by palo alto as the result of an RMA process. You won't be able to get a USB recovery image, you'll need to get a fresh disk from Palo Alto directly.

For this you will also need to have an active support license

Your first challenge will be to regain access to support. As mentioned by @kiwi your best approach is to reach out to support directly so they can inform you about the current state of the device (licensed or not) and who to contact

once you've regained access to support and the support contract is still valid, you can initiate the RMA process to replace your broken disk

hope this helps

P.S. in case the original owner has completely vanished, you can have the device recertified and connected to you via https://www.paloaltonetworks.com/services/support/support-policies/secondary-market-policy