topic Facing issue on AWS firewall with Mobile access portal in Cloud Firewall

Facing issue on AWS firewall with Mobile access portal

Blason_R — Sat, 15 Oct 2022 17:22:01 GMT

Hi Team,

I just configured the SSL VPN on AWS firewall with native authentication dang able to login but when I click on connect button it again comes back to Mobile Access portal agent installer and getting below error in Smartview Tracker.

Reason Error in disconnecting user

Action Reject

I searched through skand sk 63880 was relevant which says if office mode pool is same as backend IP. I later changed and installed the policy; Even restarted the CP service however issue remains same.

Any idea?

TIA

Blason R

Re: Facing issue on AWS firewall with Mobile access portal

Blason_R — Sat, 15 Oct 2022 17:48:28 GMT

Just done the debug and seeing this error

23839][15 Oct 23:12:52][SessionIS] [CVPN_WARNING] SessionIS::DisabledSessionDatabase::secureSelectQuery: Database is disabled
[23839][15 Oct 23:12:52][SessionIS] [CVPN_WARNING] SessionIS::DisabledSessionDatabase::getEmptyResult: Database is disabled
[23839][15 Oct 23:12:52][SESSION_MANAGER] [CVPN_WARNING] SessionIS::SessionManager::ownerSessionIdToSessionId: Secure select query failed
[23839][15 Oct 23:12:52][SESSION_UTILS] [CVPN_ERROR] VPNSession::VpnSessionServices::updateOmIpAndSessionTimeout: Failed to retrieve a SIS session ID for VPN Session ID: {0x39939b83,0x634af11c,0x1501010a,0x5d1f}
[23839][15 Oct 23:12:52][ANY] Exception: Failed to update office mode IP and session timeout
[23839][15 Oct 23:12:52][SESSION_UTILS_ApiC] [CVPN_ERROR] update_om_ip_and_session_timeout: Exception thrown: Failed to update office mode IP and session timeout
[23839][15 Oct 23:12:52][tunnel] save_login_info: Failed to update office mode ip and session timeout
[23839][15 Oct 23:12:52] destroy_login_info: begin

Re: Facing issue on AWS firewall with Mobile access portal

Blason_R — Sun, 16 Oct 2022 06:40:34 GMT

Ok - Issue is resolved. Since this is a AWS. I had given the cluster public IP on SSL portal setting when logs are checked with fw ctl zdebug we observed that port 443 is being dropped on stealth rule hence had to allow port 443 for firewall.