Facing issue on AWS firewall with Mobile access portal

[Blason_R]

Hi Team,

I just configured the SSL VPN on AWS firewall with native authentication  dang able to login but when I click on connect button it again comes back to Mobile Access portal agent installer and getting below error in Smartview Tracker.

Reason Error in disconnecting user

Action Reject

I searched through skand  sk 63880 was relevant which says if office mode pool is same as backend IP. I later changed and installed the policy; Even restarted the CP service however issue remains same. 

Any idea?

TIA 

Blason R

[Blason_R]

Just done the debug and seeing this error

23839][15 Oct 23:12:52][SessionIS] [CVPN_WARNING] SessionIS::DisabledSessionDatabase::secureSelectQuery: Database is disabled
[23839][15 Oct 23:12:52][SessionIS] [CVPN_WARNING] SessionIS::DisabledSessionDatabase::getEmptyResult: Database is disabled
[23839][15 Oct 23:12:52][SESSION_MANAGER] [CVPN_WARNING] SessionIS::SessionManager::ownerSessionIdToSessionId: Secure select query failed
[23839][15 Oct 23:12:52][SESSION_UTILS] [CVPN_ERROR] VPNSession::VpnSessionServices::updateOmIpAndSessionTimeout: Failed to retrieve a SIS session ID for VPN Session ID: {0x39939b83,0x634af11c,0x1501010a,0x5d1f}
[23839][15 Oct 23:12:52][ANY] Exception: Failed to update office mode IP and session timeout
[23839][15 Oct 23:12:52][SESSION_UTILS_ApiC] [CVPN_ERROR] update_om_ip_and_session_timeout: Exception thrown: Failed to update office mode IP and session timeout
[23839][15 Oct 23:12:52][tunnel] save_login_info: Failed to update office mode ip and session timeout
[23839][15 Oct 23:12:52] destroy_login_info: begin

[Blason_R · Accepted solution]

Ok - Issue is resolved. Since this is a AWS. I had given the cluster public IP on SSL portal setting when logs are checked with fw ctl zdebug we observed that port 443 is being dropped on stealth rule hence had to allow port 443 for firewall.