Focus

Configure Device Access One-Time Password

Table of Contents

Filter

Expand All | Collapse All

Prisma SD-WAN Docs

Administration
Deployment
Incidents & Alerts
CloudBlades
Version
- AWS Transit Gateway
- Azure vWAN
- Azure vWAN with vION
- ChatBot for MS Teams
- ChatBot for Slack
- CloudBlades Integration with Prisma Access
- GCP NCC
- Service Now
- Zoom QSS
- Zscaler Internet Access
Reference
Release Notes
Version
- ION 5.2
- ION 5.3
- ION 5.4
- ION 5.5
- ION 5.6
- ION 6.0
- ION 6.1
- ION 6.2
- ION 6.3
- ION 6.4
- New Features Guide
- On-Premises Controller
- Prisma Access CloudBlade Cloud Managed
- Prisma Access CloudBlade Panorama Managed
- Prisma SD-WAN CloudBlades

Assign the ION Device

Configure the ION Device at a Branch Site

Configure Device Access One-Time Password

Learn how to configure device access OTP in Prisma SD-WAN.

Where Can I Use This?	What Do I Need?
Prisma SD-WAN	Active Prisma SD-WAN license

Device Access One-Time Password provides the ability to regain access to the device toolkit in the event that all toolkit passwords are forgotten and the device has lost connection to the controller.

In order to access an offline device, the device must be:

In a claimed or assigned state.
Offline and unable to talk to the controller.

To access the offline device:

At the console of the remote, offline device, log in with menu as the username and digital>morgueS! as the password.
Once logged in, the console menu will present command options.
Select the Status option.
This verifies that the device is offline.
Once the device is offline and has a Claim certificate installed, select Device offline Access.
This generates the Challenge phrase.
Note down the Challenge phrase.
Log in to the Prisma SD-WAN web interface as a Super user and select WorkflowsDevices.
Select a device, click the ellipsis menu, and select Generate one-time password.
Enter the Challenge Phrase provided earlier by the device console, and click Submit.

If successful, a one-time password response will be generated.
Enter this one-time password on the device console for access to the Device Toolkit.
Note the following:
- Challenge requests and incorrect entries in both forms will be logged.
- The Challenge Phrase and subsequent response is only valid for the configured number of attempts.
- Exiting from the Challenge prompt or logging out will automatically invalidate the Challenge string.
- You can modify the maximum number of one-time password attempts and expiration timeframes from ManageSystemAccess ManagementDevice AccessDevice Offline Access Policy on the Prisma SD-WAN web interface.