topic Re: Mobile Access Portal Strangeness after restore in SASE and Remote Access

Mobile Access Portal Strangeness after restore

GianniPapetti — Tue, 13 Sep 2022 06:33:50 GMT

Hi Mates,

At the end of an RMA process that saw the replacement of a node of our ClusterXL, I proceeded to restore the configuration of the old node on the new node.

The cluster works as expected. The only oddity concerns the Mobile Access Portal on the new node; unfortunately there is no authentication method that allows the user to log in as expected.

The portal is instead visible on the other currently primary node.

fw01: Restore GW after RMA - Standby in ClusterXL

fw02: Original ClusterXL Active Member

Any suggestions?
I opened a ticket to the TAC with no satisfaction.

Re: Mobile Access Portal Strangeness after restore

_Val_ — Thu, 15 Sep 2022 07:32:26 GMT

the portal issue, does it happen when your new cluster member is Active? Or are you trying to connect to the standby?

Re: Mobile Access Portal Strangeness after restore

PhoneBoy — Thu, 15 Sep 2022 15:33:58 GMT

What version/JHF is this?
It looks like something prior to R80.40, which suggests you should upgrade to a supported release.
R80.30 and R80.20 will be End of Support at the end of this month.
Earlier releases are already End of Support.

Re: Mobile Access Portal Strangeness after restore

GianniPapetti — Thu, 15 Sep 2022 15:35:45 GMT

Of course it happens when node1 is ACTIVE.

Regards,

Gianni.

Re: Mobile Access Portal Strangeness after restore

GianniPapetti — Thu, 15 Sep 2022 15:47:51 GMT

Hi,

both members are R80.40 take 156.

I think i have solved by comparing fw02 and fw01 /opt/CPcvpn-R80.40/phpincs/spPortal/idpPolicy.xml file.

In the working node the file is filled by IDP metadata instead of the file present on the fw01 node.

Also, i had a look in the backup packet made using gaia portal and the file is missed; i suppose a kind of backup bug.

Tried to copy file on the fw01 node and the login button comes up!

Next Monday i'll switch the cluster and have a try.

Regards,

Gianni.

Re: Mobile Access Portal Strangeness after restore

GianniPapetti — Mon, 19 Sep 2022 15:16:58 GMT

Hi mates,

as promised also to the TAC, this afternoon I copied the idpPolicy.xml file from the known active to the restored node and switched traffic to that gatwway,
Everything worked as expected.

By properly checking the backup package set in the GAIA Portal, the directory /opt/CPcvpn-R80.40/phpincs/ is not present where spPortal / idpPolicy.xml is located inside it.

For obvious reasons this file could not be restored.

I am definitely perplexed and asked for an explanation since now, I am terrified that the backups are inconsistent.

Thanks you all,

Gianni.