SSH and console login blocked

[ceapen01]

cannot login to Palo Alto SSH and console using super admi user. From console it shows error = "user not known to the underlying authentication module"

From SSH it shows error - " Access Denied".

SSH screenshot attached.

[akuzhuppilly]

Hello @ceapen01 

The account you used is 'admin2'.

Is this a valid superuser account present in the firewall?

Do you have any other accounts to log in? If so, please check the system logs and authd logs.

[ceapen01]

admin or admin2, which ever super admin user result is the same.

[akuzhuppilly]

Hello @ceapen01 

Here are a few other options you can try:

1. If the firewall is connected to Panorama, attempt to create a new admin account from Panorama and push it to the firewall.

2. If the firewall is in High Availability (HA) and you can log in to one firewall in the HA pair, create a local account, and synchronize the configuration.

If there is no other way to log in to the firewall, you may need to perform a factory reset, as explained in the following KB: 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClK2CAK

[ceapen01]

Firewall is not connected to panorama. We tried creating local user from secondary firewall, still no luck.

[akuzhuppilly]

So, you mean to say you are able to connect to the Passive FW?

What does the config sync status show in the HA details?

If you are making a change on the Passive FW (such as creating a new local account), you will need to sync the config (if it's not already in sync) from Passive to Active.

[BlairTurner]

The error message indicates the user is not recognized by the authentication module.

[rmfalconer]

Do you have these accounts set with Role Based access? 

[ceapen01]

the config is getting synced successful, but cannot login to primary firewall CLI using any admin credentials.