Tip for web UI access issue

[the_rock]

Hey guys,

Figured would share something that could potentially help others if you were to ever encounter this problem. Worked with customer on upgrading their 3 member cluster from R80.40 jumbo 161 to R81.10 jumbo 94, but I totally forgot the fact he told me they had one member where web UI would log them in, but then as soon as they went to any tab, it would log them out and even clish / ssh commands would be very sporadic.

They dont know for sure when this happened, but at some point in R80.40, out of the blue and it would affect all users, not just admins. TAC told them to do cpstop/cpstart, reboot, soft shutdown, confd restart, nothing helped. Even trying all sort of browsers (even incognito mode) did not make any difference.

We ended up doing hard powercycle and that solved the issue, so we were confident upgrading afterwards.

Anyway, thought would share this, so if anyone ever faces this problem, thats easiest way to solve it.

Cheers.

[Blason_R]

Well I specifically have faced this issue and keen to know if platform-portal is listening on port 443? In my case I changed to some random port and installed the policy. Like 9443 and it started working fine. 

[the_rock]

They told me TAC tried many different ports and none worked. It was on custom port, 8443.

[Blason_R]

Hmm - Then definitely it seem to be a bug I believe.

[the_rock]

Not necessarily, more a "mystery" lol. Its 3 member A-P cluster, only one fw had this issue. Anyway, all good now!

[Zee]

Hi,

Just saw this, I am also facing the same issue. Out of no where one of the cluster fw and VIP is not responding to 8443. I can access via ssh and everything is working but web gui is not working . Do you have any suggestions to resolve without impact traffic as currently its in production environment

[the_rock]

What version? One easy thing to try would be turn off web daemon, save config, turn it back on and/or do same thing with web ui port number (change to another random port, save, then change back to original one, save).

Message me offline, I should be free in 1 hour, will be on my break, but can do remote if you are allowed to do that.

Andy

[Zee]

Unfortunately, not allowed for remote session. The version is R81.20 and it cam out of no where. So should I try to just disable web daemon and enable or should I change the port as well. I don't want to reboot or something without maintenance window

[the_rock · Accepted solution]

Just disable deamon, save, re-enable, save. If that fails, then do same with port number. Change to random one, save, change back to original one, save, install policy, test.

Andy

[Zee]

Interesting thing is , it happened to VIP, active node, backup all at once. I will follow this and let you know.

[the_rock]

Sounds good.

[Zee]

Since I am unable to access Gaia portal, my vpn client is not working as well, although i can connect with Capsule Mobile app. Secondly, do you think Platform Portal option can affect this as well?

[the_rock]

Its recommended to have web ui platform port set to something other than 443.

Andy

[Zee]

It worked. Thanks.

[the_rock]

Great! which method?

Andy

[Zee]

Port changed. We actually had a discussion on a VPN Tunnel issue as well which is still on going and I am unable to resolve it neither TAC 😛 and on the same fw I got this today.

[the_rock]

Well, sometimes those things come with experience, specially if people had seen it too many times...I had issues like that happened even back in R55, so its all in my head as far as basic things to try : - )

Andy

[Zee]

True, I once had this issue on untangle firewall. But with Checkpoint, I am relatively new its been few months I have started working on it. Thank you for the hint. I hope VPN resolves as well somehow 🙂

[the_rock]

Its all good, we are here to help. No one is born knowing everything, so no one can judge others if they dont know/cant solve something, no shame in that.

Andy