topic Re: GUI is not loading for checkpoint security gateway's in Firewall and Security Management

GUI is not loading for checkpoint security gateway's

Surendra — Wed, 04 Sep 2024 08:17:42 GMT

Hi Team

GUI is not loading for checkpoint security gateway's

getting below error.

ERR_SSL_PROTOCOL_ERROR

Re: GUI is not loading for checkpoint security gateway's

Duane_Toler — Wed, 04 Sep 2024 13:33:58 GMT

Looks like you're using Gaia WebUI. This error is from your browser which doesn't like the TLS version being negotiated. Your browser may have a TLS configuration imposed by a GPO from your organization. You can try with Firefox instead to see if that works. For example, depending on your gateway configuration, the Gaia portal may not be able to support TLS 1.3:

https://support.checkpoint.com/results/sk/sk178505

If your GPO enforces TLS 1.3, then this may be your issue.

Re: GUI is not loading for checkpoint security gateway's

Lesley — Wed, 04 Sep 2024 13:44:23 GMT

Can you confirm that this firewall is still running supported software? 90% of the time this error is related to ancient firewall software

Re: GUI is not loading for checkpoint security gateway's

the_rock — Wed, 04 Sep 2024 17:10:20 GMT

What version? You can always try change web UI port and test

clish -> set web ssl-port 4434 -> save config -> test

If that fails, I would try open old school Internet explorer and see if that works

https://superuser.com/questions/1824875/where-is-internet-options-now-that-internet-explorer-is-gone

control panel -> internet options -> programs -> manage add-ons -> learn more about toolbars and extensions

Andy

Re: GUI is not loading for checkpoint security gateway's

PhoneBoy — Wed, 04 Sep 2024 18:02:22 GMT

What version/JHF is the device?
Older (out of support) versions may not support the ciphers mandated by current web browsers.

Re: GUI is not loading for checkpoint security gateway's

Surendra — Thu, 05 Sep 2024 09:54:16 GMT

R81_10_JUMBO_HF_MAIN Take: 139

Re: GUI is not loading for checkpoint security gateway's

the_rock — Thu, 05 Sep 2024 11:19:32 GMT

Did you try what we suggested?

Andy

Re: GUI is not loading for checkpoint security gateway's

PhoneBoy — Thu, 05 Sep 2024 19:24:37 GMT

Did you check to see if your organization enforces the use of TLS 1.3 as suggested by @Duane_Toler ?

Re: GUI is not loading for checkpoint security gateway's

Surendra — Fri, 06 Sep 2024 09:17:54 GMT

organization enforced to use TLS 1.2 and same is configured in gateway as well.

Re: GUI is not loading for checkpoint security gateway's

PhoneBoy — Fri, 06 Sep 2024 12:42:44 GMT

Can you reach the gateway via other means (e.g. ssh)?
What is the network path between your client and the gateway and does it include any other firewalls?

Re: GUI is not loading for checkpoint security gateway's

Surendra — Fri, 20 Sep 2024 15:13:29 GMT

VPN blade is not enabled, what is the process for renewal for self signed certificate in gateway ?

self signed certificate renewal fixed the issue.

Re: GUI is not loading for checkpoint security gateway's

the_rock — Fri, 20 Sep 2024 15:24:18 GMT

Thats odd, can you send screenshot of that vpn tab? How did you renew it if blade is not even on??

Re: GUI is not loading for checkpoint security gateway's

Surendra — Fri, 20 Sep 2024 15:26:04 GMT

CP Support did that, i am not sure about that.

Re: GUI is not loading for checkpoint security gateway's

the_rock — Fri, 20 Sep 2024 16:09:55 GMT

Do you have commands they ran?

Andy

Re: GUI is not loading for checkpoint security gateway's

Lesley — Fri, 20 Sep 2024 20:00:28 GMT

This is documented in https://support.checkpoint.com/results/sk/sk97792

VPN certificate is not only used for interal VPN but also for:

Multi-Portals (Mobile Access Portal, Identity Awareness Captive Portal, User Check Portal, and so on).
Gaia Portal with enabled Multi-Portal feature.

Re: GUI is not loading for checkpoint security gateway's

the_rock — Fri, 20 Sep 2024 20:10:49 GMT

Ah, that sk...seen it before, though personally, I always thought there was an easier way to do this rather than enabling/disabling the blade 🙂

Andy