>
    Configure an SSH Service Profile
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. Certificate Management
    4. Configure an SSH Service Profile
    Download PDF

    Configure an SSH Service Profile

    Table of Contents

    Configure an SSH Service Profile

    Create an SSH service profile to harden SSH connections to your management and HA appliances.
    SSH service profiles enable you to customize SSH parameters to enhance the security and integrity of SSH connections to your Palo Alto Networks management and high availability (HA) appliances. By default, SSH supports all ciphers, key exchange algorithms, and message authentication codes, which leaves your connection vulnerable to attack. In an SSH service profile, you can restrict the algorithms your SSH server supports. You can also generate a new host key and specify data volume, time, and packet-based thresholds for SSH session key regeneration and exchange.
    Depending on the SSH server instance, configure either a management or HA SSH service profile. You can configure the profiles from your firewall, Panorama™ web interface (if applying settings to multiple firewalls or appliances), or CLI.
    You can configure a maximum of four management and four HA server profiles.
    To use the same SSH connection settings for each Dedicated Log Collector (M-series or Panorama virtual appliance in Log Collector mode) in a Collector Group, configure an SSH service profile from the Panorama management server,
    Commit
     your changes to Panorama, and then
    Push
     the configuration to the Log Collectors. You can also perform these steps from the CLI using
    set log-collector-group <name> general-setting management ssh
     commands.

    Create an SSH Management Profile

    To customize SSH settings for management connections, create an SSH management profile.
    1. Create a Management - Server Profile.
      1. Select
        Device
        Certification Management
        SSH Service Profile
        .
      2. Add
         a Management - Server Profile.
      3. Enter a
        Name
         to identify the profile.
      4. (
        Optional
        )
        Add
         the ciphers, message authentication codes, or key exchange algorithms the profile supports.
      5. (
        Optional
        ) Select a
        Hostkey
         and key length.
      6. (
        Optional
        ) Enter values for the SSH session rekey parameters:
        Data
        ,
        Interval
        , and
        Packets
        .
      7. Click
        OK
         and
        Commit
         your changes.
    2. Select a management profile to apply.
      1. Select
        Device
        Setup
        Management
        .
      2. Under SSH Management Profiles Settings, select an existing profile.
      3. Click
        OK
         and
        Commit
         your changes.
    3. Restart management SSH service from the CLI to apply the profile.
      You need to restart the connection each time you apply a new profile or make changes to a profile in use. Configuration changes do not affect active sessions, and new profiles apply to subsequent connections (or sessions).
      Use the
      set ssh service-restart mgmt
       CLI command.

    Create an SSH HA Profile

    To secure SSH communications between appliances in an HA pair, create an SSH HA profile. Before you create a profile, establish an HA connection between the HA peers. To establish an HA connection, you’ll need to enable encryption on the control link connection, export the HA key to a network location, and import the HA key on the peer. (See Configure Active/Passive HA or Configure Active/Active HA.)
    1. Create an HA Profile.
      1. Select
        Device
        Certification Management
        SSH Service Profile
        .
      2. Add
         an HA Profile.
      3. Enter a
        Name
         to identify the profile.
      4. (
        Optional
        )
        Add
         the ciphers, message authentication codes, or key exchange algorithms the profile supports.
      5. (
        Optional
        ) Select a
        Hostkey
         and key length.
      6. (
        Optional
        ) Enter values for the SSH session rekey parameters:
        Data
        ,
        Interval
        , and
        Packets
        .
      7. Click
        OK
         and
        Commit
         your changes.
    2. Select an HA Profile to apply.
      1. Select
        Device
        High Availability
        General
        .
      2. Under SSH HA Profile Setting, select an existing profile.
      3. Click
        OK
         and
        Commit
         your changes.
    3. Restart HA1 SSH service from the CLI to apply the profile.
      You need to restart the connection each time you apply a new profile or make changes to a profile in use. Configuration changes do not affect active sessions, and new profiles apply to subsequent connections (or sessions).
      Use the
      set ssh service-restart ha
       CLI command.
      If a connection exists between the appliances in the HA pair, you can use the following commands to minimize the downtime that accompanies an SSH service restart.
      • (
        HA1 Backup is configured
        ) admin@PA-3260>
        request high-availability session-reestablish
      • (
        No HA1 Backup is configured or HA1 Backup link is down
        ) admin@PA-3260>
        request high-availability session-reestablish force
        You can force the firewall to reestablish HA1 sessions if there is no HA1 backup. However, this causes a brief split-brain condition, where the HA peers cannot detect each other and assume an active role as a result. (Using the
        force
         option when an HA1 backup is configured has no effect.)

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.