topic Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2019 in Firewall and Security Management

Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2019

SW-ASSETS — Fri, 12 Mar 2021 01:08:39 GMT

We have upgraded the da agent last night for the gateway but web UI and cli not accessible after that ..someone please help to resolve this.there are no errors while accessing the webui but there is a blank page

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

PhoneBoy — Fri, 12 Mar 2021 05:27:42 GMT

The deployment agent should not impact the WebUI and CLI access at all.
And you’ve given us no other information, like version/JHF, or what precisely occurs when you try to access via WebUI (beyond a blank page) or CLI.
You should be able to access via console if nothing else.

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

SW-ASSETS — Fri, 12 Mar 2021 05:33:21 GMT

I have installed latest hotfix 2019 yesterday.Installation was successful.But when I tried to open the WebUI ,its just showing blank ,no login option

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

Vincent_Bacher — Fri, 12 Mar 2021 06:29:36 GMT

First try well known basic steps clearing browser cache, using different browsers and so on.

And what are the symptoms when trying to connect using ssh?(

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

SW-ASSETS — Fri, 12 Mar 2021 07:05:17 GMT

@vincent I have tried everything -cleared browser cache,tried with enabling javascript but still failed to load the WebUI.

For SSH its getting the error as "User XXXX is getting denied through CLI"

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

MartinTzvetanov — Fri, 12 Mar 2021 08:51:12 GMT

did you try to reboot the device? In the past I had few situations when after DA is upgraded it didn't start, so I had to start it manually, which in your case can't be done because you don't have ssh. DA has nothing in common with ssh so the problem with ssh should be somewhere else.

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

Norbert_Bohusch — Fri, 12 Mar 2021 11:21:47 GMT

This error looks like you are using TACACS or Radius authentication and the authorization is not working properly.

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

G_W_Albrecht — Fri, 12 Mar 2021 11:35:29 GMT

Did you delete the old Certificate from this IP in browser ?

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

SW-ASSETS — Fri, 12 Mar 2021 12:00:34 GMT

Yes Albrecht.

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

SW-ASSETS — Fri, 12 Mar 2021 12:08:29 GMT

TAC has suggested to reboot now.

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

SW-ASSETS — Fri, 12 Mar 2021 12:11:36 GMT

No its not using TACACS or Radius authentication and the authorization.

Re: Unable get the webui and cli access of Checkpoint gateway after upgrading cpuse da agent build 2

Boaz_Orshav — Fri, 12 Mar 2021 16:02:55 GMT

Just want to make it clear - there is no way the deployment agent (DA) can block SSH.

Even if it's down or crashing or whatever other problem that might happen - the DA can't cause ssh connections to be blocked.

The issue you are facing is not sure to the DA update but maybe some other updates happened during the same time.

Will appreciate if you run "da_cli collect_logs" on the machine and send me the resulted tgz (boazo@checkpoint.com) just to check if other things happened approximately on the same time.