Access to PA-200 Web GUI is Denied.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Access to PA-200 Web GUI is Denied.

L1 Bithead

When I open up a https://if_of_pa-200

I get access denied message with You dont have authorization to view this page.

I have logged into this firewall many times before but have not for several months now.

I can use putty to get into the console.  I found some online solution that would give this error is I was out of space.

My root partition was at 95%.   I was able to get it to 93 but not any lower.  Not sure what else I can delete but that did not resolve this issue.

I started looking at the certificates and followed other instructions on generating a new SSL cert but that also did not resolve the issue.

Not sure what else I can look at to fix this issue.  

10 REPLIES 10

L2 Linker

What version of PAN-OS is the PA-200 running? Sounds like either the authentication or apache processes have done an oops (probably the latter, since you can auth via CLI). You can either restart them individually;

"How to Restart the Web-related Processes" - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POIHCA4

 

Or, I'd recommend just restarting the whole management server:

"How to Restart the Management server "mgmtsrvr" Process" - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClaGCAS

 

 

If that doesn't help, reboot the box.

Kiki

L1 Bithead

Sadly that did not fix the issue.  Since I cant get in to see what version I have I believe it is 8.x.  What is odd is that the documentation shows you should see a process for web_backend, but it looks like that has been replaced with webapp but not sure.  Cannot find how to reset certificate on the PA since I think this is my issue.  Only one computer gives me this access denied error.  All other when I try to go the the browser IP, I get site cannot be found.

Interesting - to clarify, did you end up rebooting the box?

 

You should be able to get into the CLI and remove the SSL/TLS Service Profile that's applied to the management interface - it'll then start using the built-in self-signed webgui certificate.

 

Since it sounds like you can get into the console, you can just run "show system info" to get the PAN-OS version and other key details.

 

Failing everything, if you can console in you can save a named config version, export it via SCP or TFTP, and factory reset the box (though there are various things you can try before then).

Kiki

Cyber Elite
Cyber Elite

Hello,

Have you tried a different browser, such as IE?

Regards,

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!