Access CLI through WebUI not working with default port 5555

[genisis__]

Recently installed a pair of Spark appliances running R82.00.10.  I attempted to access the CLI using the option in the WEBUI which was via Firefox (See below, the issue is not seen using Edge):

When clicking on CLI button, the below was presented with an untrusted certificate, now in the new dialog box there was no option to actually accept the untrusted certificate (this was out of the box certificate b.t.w).

The client itself initiates a connection on port TCP/5555 (believe this is a SSL based connection) back to the appliance
This issue appears to be more a firefox problem rather then a Checkpoint one (but I would debate the potentially port 5555 should not be used, and full GAIA appliances don't experience the same issue).

How was this resolved:
With the above screenshot open, add a certificate ie.  <IP>:5555

Once this is done, your CLI connection should work.
I would like to request Checkpoint investigate this further with the firefox browser, and potentially change this so it works using port 22 perhaps?

TAC are aware of this.

[the_rock]

Is it same issue regardless of what browser you use?

[genisis__]

No - I tested with Firefox and Edge, and the issue only appeared in Firefox.
I have another issue related to device certs, which may be the same type of resolution, TAC are investigating that through a separate case, but have verified I've done everything correctly.

[the_rock]

Try set below to false, restart browser, try again.

 

[genisis__]

But why would that make a difference when the issue is firefox actually requiring an open connection into the GW so it can retrieve the cert?

I can certainly give it a try, but would I want to leave it like that, I'm not sure.

[the_rock]

Just to see if quic protocol could be causing it.

[Tom_Hinoue]

For the WEB CLI, port 5555 could be changed to a different port from advanced settings on a supported version.
Just for testing, maybe changing the port will resolve the error on Firefox?

See here:
Connections to Port 5555 Fail on Quantum Spark Devices
https://support.checkpoint.com/results/sk/sk183637

I'm not sure if changing the port to 22 will work with the current design though.

[the_rock]

Good call, Tom. Appears even with higher version, those commands mignt be needed.

[genisis__]

We did try this, changed the port to 6666 as an example but still this did not work.  I did ash about changing the port to 22, but we did not try this, way...It looks like the connection is SSL based not SSH based.

[PhoneBoy]

Considering the entire purpose of this feature is to not have to use a native SSH client, the communication must occur over HTTPS.
Due to the embedded nature of the OS on Spark devices (not to be confused with SPARC devices), the web server implementation is different than regular appliances.
As such, that communication needs to occur over a different port, which can be changed.

I find it odd that Firefox doesn't give an option to "Accept and Continue" (as it did when I connected to the appliance) and I have to go through the process of fully trusting the self-signed certificate.

[genisis__]

Totally agree, TAC even replicated it, but said it was a firefox issue, which on the face of it, it does look like it, however I think Checkpoint should be looking to resolve this, because firefox is widely used.

For me - by posting the issue and resolution I came to here, will help others facing this strange issue.

[the_rock]

Totally valid point, Firefox should work.