topic Re: LOM Session Expired - LOM Firmware 6.10.0 in Firewall and Security Management

LOM Session Expired - LOM Firmware 6.10.0

Sajenthiran_Mic — Thu, 23 Jun 2022 12:13:37 GMT

During Checkpointb restoration from R81 to R80.40. The LOM session has expired. At the same time the restoration process did not complete. Now getting back into the LOM (LOG IN ) is denied with the message "LOM session has expired." Message.

Fixed:

ipmitool mc reset cold

service ipmi stop; service ipmi start

a complete system reboot

Re: LOM Session Expired - LOM Firmware 6.10.0

Vladimir — Mon, 20 Jun 2022 15:45:40 GMT

Try using browser's Incognito mode. Perhaps it's a cached session issue.

Re: LOM Session Expired - LOM Firmware 6.10.0

Dolev — Tue, 21 Jun 2022 05:19:56 GMT

Do you have open SR with Check Point Support? If you do, please mention it here, if not then open one and update here.

I'll follow up with TAC on that.

Re: LOM Session Expired - LOM Firmware 6.10.0

skandshus — Tue, 21 Jun 2022 18:05:19 GMT

Seeing the same thing here 😞 havent found a fix

Re: LOM Session Expired - LOM Firmware 6.10.0

George_Ellis — Tue, 21 Jun 2022 19:02:31 GMT

Do you have GAIA access at all either by console or SSH session? If so, you should be able to reboot the LOM.

service ipmi start

#reboot
ipmitool mc reset warm

ipmitool mc reset cold

service ipmi stop

Re: LOM Session Expired - LOM Firmware 6.10.0

Christian_Opitz — Wed, 22 Jun 2022 11:33:52 GMT

We noticed the same error on three different HTML5 LOMs this week. 2x6000 and one 7000 Appliance. There were no system changes. Maybe a global issue on HTML5 LOMs?

A ipmi restart with warm reset did not help. Also a change of the LOM IP address via clish did not change the behavior.

Re: LOM Session Expired - LOM Firmware 6.10.0

George_Ellis — Wed, 22 Jun 2022 13:33:18 GMT

Have you tried different browsers? In ancient times, I had to use Chrome and Mozilla at times to work around an issue. Or Firefox or MS browsers were the fix. Maybe you got a GPO push from the desktop team that included some security measure that is precluding it (and the alternate browser may not have that setting.)

Edit - PS, little known browser feature. Ctrl + reload usually forces a cache skip. Not that that will help.

Re: LOM Session Expired - LOM Firmware 6.10.0

Christian_Opitz — Wed, 22 Jun 2022 11:59:06 GMT

thanks. We tried Chrome, Firefox, Edge and IE on different sources with the same result. The same from the LOM subnet (without a gateway). All tests were done with an uptodate Windows 10.

Re: LOM Session Expired - LOM Firmware 6.10.0

George_Ellis — Wed, 22 Jun 2022 15:47:29 GMT

Call support. If you have a test box (as we do not test in production, right...), ipmitool could help. Creating another user looks like it is on the realm of possibility.
'ipmitool set name 3 newguy'
'ipmitool set password 3 somethinglongerthan8chars'
'ipmitool user priv 3 ADMINISTRATOR 1'
'ipmitool user enable 3'

ipmitool user
User Commands:
summary [<channel number>]
list [<channel number>]
set name <user id> <username>
set password <user id> [<password>]
disable <user id>
enable <user id>
priv <user id> <privilege level> [<channel number>]
test <user id> <16|20> [<password]>

That should give you newguy and not have an existing session. But beware, I do not have anything to test against, so this may not work and could be wrong.

Re: LOM Session Expired - LOM Firmware 6.10.0

Christian_Opitz — Thu, 23 Jun 2022 11:00:53 GMT

we don't have a test box, too. The support currently want to test a deenergize of the system for some minutes currently.

Re: LOM Session Expired - LOM Firmware 6.10.0

George_Ellis — Thu, 23 Jun 2022 11:36:52 GMT

You could do a 'ipmitool mc reset cold' for an alleged cold boot of the device if you have not done so. That would get you half way to a full deenergize.

Re: LOM Session Expired - LOM Firmware 6.10.0

Christian_Opitz — Mon, 27 Jun 2022 11:40:15 GMT

The deenergize of the server helps to get the LOM working again. Tomorrow there will be a test with the cold reset command, too.

Re: LOM Session Expired - LOM Firmware 6.10.0

skandshus — Mon, 27 Jun 2022 11:52:00 GMT

what does "de energize mean"? is that slang for pulling the power? 🙂

Re: LOM Session Expired - LOM Firmware 6.10.0

George_Ellis — Mon, 27 Jun 2022 13:37:04 GMT

Unplug from all power. The LOM is on whenever there is power to the unit. This allows the LOM to also manage power on/off for the firewall. You can cold start the firewall via the LOM.

Re: LOM Session Expired - LOM Firmware 6.10.0

Christian_Opitz — Tue, 28 Jun 2022 07:23:14 GMT

good news. "ipmitool mc reset cold" worked also without outages :).

Re: LOM Session Expired - LOM Firmware 6.10.0

George_Ellis — Tue, 28 Jun 2022 10:50:06 GMT

Great news. Remote solutions rock.