topic Re: management GUI issue in General Topics

management GUI issue

lauro7 — Thu, 11 Jul 2013 10:05:32 GMT

Hi,

I have a PA-200 with PANOS 4.1.13.

After some changes in configuration and after a commit, I lost connection to the management interface and now it is impossible to connect by web GUI.

Only SSH CLI is running. How can I check by CLI what happened ? The system services SSH, HTTPS and PING are enabled and all IP are permitted to connect to management interface. The system process mgmtsrvr is running and the group mgmt_service is running.

Thanks.

Re: management GUI issue

Retired Member — Thu, 11 Jul 2013 10:12:49 GMT

try that

debug software restart web-server

Re: management GUI issue

lauro7 — Thu, 11 Jul 2013 10:23:50 GMT

I have tried, but Web GUI is still not running.

Re: management GUI issue

Retired Member — Thu, 11 Jul 2013 10:27:40 GMT

did you try restarting management also ?

debug software restart management-server

Re: management GUI issue

lauro7 — Thu, 11 Jul 2013 10:35:58 GMT

Yes, I tried, but this is the output. I think it is for the cli connection lost.

But GUI is still not running.

Thanks.

____________________________________________________

Process 'mgmtsrvr' executing RESTART

Jul 11 12:30:26 Error: pan_read_full(comm_utils.c:97): srvr: fatal recv error. sock=3 err=Connection reset by peer (131)

admin@FW12003>

_____________________________________________________________________________

Re: management GUI issue

UhMayYeah — Thu, 11 Jul 2013 11:25:33 GMT

Two options:

1>You can reload the config version that allowed https

# load config version <version>

#commit

2>Try enabling http

# set deviceconfig system service disable-http no

#commit

Re: management GUI issue

Retired Member — Thu, 11 Jul 2013 11:27:30 GMT

yes that will resolve I missed "After some change"

Re: management GUI issue

lauro7 — Thu, 11 Jul 2013 11:40:43 GMT

I tried http, but the output was this:

Web Page Blocked

Access to the web page you were trying to visit has been blocked in accordance with company policy. Please contact your system administrator if you believe this is in error.

User: 192.168.86.167

URL: 192.168.2.2/

Category: private-ip-addresses

and that is strange....192.168.2.2 is the management IP address...

Re: management GUI issue

Retired Member — Thu, 11 Jul 2013 11:47:04 GMT

goto configure mode

set rulebase security rules new from any to any destination 192.168.2.2 action allow

move rulebase security rules new top

commit

Re: management GUI issue

lauro7 — Thu, 11 Jul 2013 13:03:04 GMT

Hi Panos,

I have solved with the rule "new" that you suggested. With this rule at top I am able to connect by HTTP and HTTPS.

The problem was that my customer, by himself, introduced a rule at bottom like "deny any any any any...."

after the normal rules to log all traffic denied ("after some changes he said me" ). He said that in previous PANOS releases ( e.g. 4.1.8) this "deny all rule" worked fine....I don't know...but I suggest him to specify in the deny rule at least one source zone and not any.. any. What is your opinion ?

Thanks.

Regards

Lauro

Re: management GUI issue

Retired Member — Thu, 11 Jul 2013 13:10:07 GMT

when using any any deny you should be careful not to disconnect any intra traffic so you should add intrazone allow rules.

trust trust allow

dmz dmz allow

any any deny

also you should check what you need to open for untrust to untrust and allow that also(tcp 443 , udp 500 etc..)