Since the introduction of the new recovery console. If you've setup a firewall only allowing certain IP access to SSH, your unable to connect unless you either remove the firewall rules or add a bunch of additional IP addresses that may or may not change. I wasn't able to find this in the documentation.

Please automatically take this into consideration from your end where customers have SSH locked down safe-list the recovery console IP's. You could also create a autocomplete field "Console Recovery" where customers could include on the firewall, where they could opt-in or not at their own discretion.

Thank you for your consideration.