Fresh Install of R82 into VMWare - ERR_CONNECTION_REFUSED before First Time Wizard started

[Secret-goblin-5]

Fresh R82 install (Check_Point_R82_T779).

I am on the same subnet as the VM.

I can ping, and SSH into the new VM, but cannot connect with a browser.

I get the error 

This site can’t be reached

x.x.x.245 refused to connect.

ERR_CONNECTION_REFUSED

Mgmt port is set to eth0 (only port on vm)
IP is static config, and is correct (default gateway, subnet mask etc)
VM is entirely new, no config at all except basics like passwords and disk size.



Any idea what is causing this?

[Timothy_Hall]

How much RAM is allocated?  The minimum for version R82 is now 8GB, up from 4GB in R81.20.

[Secret-goblin-5]

RAM set to 10gb

[the_rock]

Make sure initial policy is not applied, if it is, verify by running fw stat, if so, then execute fw unloadlocal. Mind you, even with initial policy, https and ssh would work. Check below in clish:

show web ssl-port

[Secret-goblin-5]

In order to configure your system, please access the Web UI and finish the First Time Wizard.
gw-93c8fe> show web ssl-port
web-ssl-port 443
gw-93c8fe> fw unloadlocal
 Local host is not a FireWall-1 module
gw-93c8fe>

[the_rock]

Ah, got it, so its just the management server. Check what Tim suggested, that could be the issue, for sure.

[emmap]

Make sure you explicitly put the 'https' into the address bar. It won't auto-redirect from http.

[Secret-goblin-5]

Already tried this (been caught out by this before!) but it's not this.

Tried using HTTPS in the address and :443 as well, neither made a difference.

[Chris_Atkinson]

Any conflicting proxy settings in the browser?

What do you see with tcpdump on the VM when you attempt the HTTPS connection?

[Secret-goblin-5]

Not great with TCP dump but this looks to me like the traffic is hitting, but not being responded to, am I correct?

[Expert@gw-93c8fe:0]# tcpdump -i eth0 src net x.x.x.9/32 and tcp and port 443
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
09:03:58.078385 IP x.x.x.9.49953 > gw-93c8fe.https: Flags [SEW], seq 3493860344, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
09:03:58.078522 IP x.x.x.9.49954 > gw-93c8fe.https: Flags [SEW], seq 1790946439, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
09:03:58.329152 IP x.x.x.9.49955 > gw-93c8fe.https: Flags [SEW], seq 3641794275, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
09:03:58.579348 IP x.x.x.9.49953 > gw-93c8fe.https: Flags [S], seq 3493860344, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
09:03:58.579456 IP x.x.x.9.49954 > gw-93c8fe.https: Flags [S], seq 1790946439, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
09:03:58.829606 IP x.x.x.9.49955 > gw-93c8fe.https: Flags [S], seq 3641794275, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
09:03:59.080748 IP x.x.x.9.49954 > gw-93c8fe.https: Flags [S], seq 1790946439, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
09:03:59.080811 IP x.x.x.9.49953 > gw-93c8fe.https: Flags [S], seq 3493860344, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
09:03:59.329783 IP x.x.x.9.49955 > gw-93c8fe.https: Flags [S], seq 3641794275, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
^C
9 packets captured
9 packets received by filter
0 packets dropped by kernel
[Expert@gw-93c8fe:0]#

[Duane_Toler]

Check your allowed-client list and make sure it's "any" (or "any host"):

> show allowed-client all
> add allowed-client host any-host
> show allowed-client all

[Secret-goblin-5]

Thanks, doesn't look like this either

gw-93c8fe> show allowed-client all
Type                  Address                                   Mask Length

Host                  Any
gw-93c8fe> add allowed-client host any-host
gw-93c8fe> show allowed-client all
Type                  Address                                   Mask Length

Host                  Any
gw-93c8fe>

Tried on Chrome and Internet Explorer BTW, both failed to show anything.
Proxy settings in Windows are default, IE Auto detect is on, settings themselves are empty.
No proxy is in use in our network.

[Duane_Toler]

Make sure you follow the notes for VMware with R82. There are some virtual hardware changes versus older versions.

https://support.checkpoint.com/results/sk/sk104848

[Secret-goblin-5 · Accepted solution]

I used that doc to build the VM.

Apart for disk IO depth and queue IO depth I followed the instructions exactly.

I built a fresh VM and it worked perfectly, so I'm scraping this VM and just using the other one.

Thanks for trying to resolve it, but wiping and starting again fixed the issue.