Verify the SSH connection to the management port on the
firewall.
| Where Can I Use This? | What Do I Need? |
|---|
| NGFW (Managed by PAN-OS or Panorama) |
|
Palo Alto Networks firewalls come with Secure
Shell (SSH) preconfigured; firewalls can act as both an SSH server
and an SSH client. You can verify your SSH connection to the management
port of the firewall during remote access to ensure that, when you
log in remotely, you are logging in to the firewall. You can also
refresh the SSH keys and specify other options for the keys.
After
you initially log in through the console to the command-line interface
(CLI), the firewall boots up and displays six fingerprints (hashed
SSH keys). When you then remotely access the management port on
the firewall for the first time, the SSH client presents a fingerprint
to you and it must match one of the fingerprints you noted from
the console login. This match verifies that the firewall you access
remotely is your firewall and that there is no malicious device
between your device and the firewall intercepting Hello packets
or presenting a false fingerprint.
To ensure you are logging in to your firewall,
perform this task when you first access your firewall remotely (when
you
Perform Initial Configuration)
and whenever you change the default host key type or regenerate
the host keys for the management port.
