Something simple to try. Make sure initial policy is not loaded, which I have a feeling it might be. From ssh (or console), run below from expert mode:
fw stat
If it shows initial policy, run fw unloadlocal
If it shows right policy, then go to clish and run below and send the output please:
Here is example from my lab:
[Expert@quantum-firewall:0]# clish
quantum-firewall> show web
daemon-enable - Allow the web configuration tool access
session-timeout - Web configuration tool Session timeout in minutes
ssl-port - Web configuration tool SSL port number
ssl3-enabled - Allow using SSL3 to access the web configuration tool
table-refresh-rate - Web configuration table refresh rate in seconds
quantum-firewall> show web daem
quantum-firewall> show web daemon-enable
WebDaemonEnable on
quantum-firewall> show web ssl-
quantum-firewall> show web ssl-port
web-ssl-port 4434
quantum-firewall>
P.S Slight correction about initial policy...even IF initial policy is loaded, web UI will still work, but ONLY on port 443, not anything else.
Cheers mate.
Andy