topic Re: Login issue with 6.0.0? in General Topics

Login issue with 6.0.0?

Rjschultz — Thu, 30 Jan 2014 17:57:02 GMT

Has anyone noticed a login issue since upgrading to 6.0.0? It seems inconsistent, but when I log in from the outside interface, I will get the message, "Creating administrative session. Please wait". I will then get returned back to the login prompt. If I VPN in and log in from the inside interface, I will see all my hung login attempts from my outside IP. Seems like a minor issue, but it could take up management CPU resources from an unwary user. This is on a PA-500 running 6.0.0, anyone else have the same issue?

-Johnny

Re: Login issue with 6.0.0?

Retired Member — Thu, 30 Jan 2014 17:59:25 GMT

Yes saw the same issue.But after sometime it did not happen.

Something triggers that but I don't know what.

Re: Login issue with 6.0.0?

HULK — Thu, 30 Jan 2014 18:24:58 GMT

Hello Johny,

I would suggest you generate a new certificate through the CLI and update the web-server certificate setting to use it and see if the issue clears?

admin@pan.work> request certificate generate certificate-name NewWebCert name NewWebCert

admin@pan.work> configure

Entering configuration mode

[edit]

admin@pan.work# set deviceconfig system web-server-certificate NewWebCert

[edit]

admin@pan.work# commit

Thanks

Re: Login issue with 6.0.0?

Rjschultz — Wed, 12 Feb 2014 22:57:02 GMT

HULK,

Will this affect the operation of our current certificate? We only use it as a GUI certificate and don't want to have to generate another CSR or get another certificate from our CA. Thanks.

-Johnny

Re: Login issue with 6.0.0?

HULK — Thu, 13 Feb 2014 03:29:12 GMT

Hello,

Are you using any external certificate to access web-browser..?

Thanks

Re: Login issue with 6.0.0?

Rjschultz — Sat, 15 Feb 2014 01:57:56 GMT

We use the GUI certificate to access the firewall externally as well as internally through the web browser.

Re: Login issue with 6.0.0?

HULK — Sat, 15 Feb 2014 02:18:37 GMT

Thanks for your update. The above mentioned command will not affect the operation of your current certificate.

Thanks

Re: Login issue with 6.0.0?

Rjschultz — Mon, 17 Feb 2014 19:57:45 GMT

I am continuing to get this problem when I log in to the firewall after re-generating the certificate when I log in with the fqdn. When I log in through the IP address it works fine. Any ideas?

Re: Login issue with 6.0.0?

gwesson — Mon, 17 Feb 2014 20:42:40 GMT

I log in to a PA-200 using the FQDN almost daily from a remote location and have not seen this issue. I am using a public CA (godaddy) for that certificate, and it was the same cert used when I was running 5.0.10.

A couple things you might try:

1. Check the authd.log file to see if there is anything relating to the login there:

> less mp-log authd.log {hit Shift+G to go to the bottom of the log, navigation is the same as linux 'less' or VIM}

2. Turn on authd debug and check the above log again after attempting a login

> debug authd on debug {disable it afterwards with 'debug authd on info'}

3. If the auth is successful as I suspect, you may be experiencing an issue with the PHP that the GUI web server is using. There's an article on getting a PHP debug log from the GUI, though it may be difficult if you can't get in to begin with. Still, may be worth a shot:

How to Run a PAN-OS Web UI Debug

Hope this helps!

Greg