management GUI issue

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L0 Member

management GUI issue

Hi,

I have a PA-200 with PANOS 4.1.13.

After some changes in configuration and after a commit, I lost connection to the management interface and now it is impossible to connect by web GUI.

Only SSH CLI  is running. How can I check by CLI what happened ? The system services SSH, HTTPS and PING are enabled and all IP are permitted to connect to management interface. The system process mgmtsrvr is running and the group mgmt_service is running.

_

Thanks.

Tags (1)

Accepted Solutions
Highlighted
L0 Member

Hi Panos,

I have solved with the rule "new" that you suggested. With this rule at top I am able to connect by HTTP and HTTPS.

The problem was that my customer, by himself, introduced a rule at  bottom like "deny any any any any...."

after the normal rules to log all traffic denied ("after some changes he said me"  :smileywink:  ). He said that in previous PANOS releases ( e.g. 4.1.8) this "deny all rule" worked fine....I don't know...but I suggest him to specify in the deny rule at least one source zone and not any.. any. What is your opinion ?

Thanks.

Regards

Lauro

View solution in original post


All Replies
Highlighted
L6 Presenter

try that

debug software restart web-server

Highlighted
L0 Member

I have tried, but Web GUI is still not running.

Highlighted
L6 Presenter

did you try restarting management also ?

debug software restart management-server

Highlighted
L0 Member

Yes, I tried, but this is the output. I think it is for the cli connection lost.

But GUI is still not running.

Thanks.

____________________________________________________

Process 'mgmtsrvr' executing RESTART

Jul 11 12:30:26 Error: pan_read_full(comm_utils.c:97): srvr: fatal recv error. sock=3 err=Connection reset by peer (131)

admin@FW12003>

_____________________________________________________________________________

Highlighted
L5 Sessionator

Two options:

1>You can reload the config version  that allowed  https

# load config version <version>

#commit

OR

2>Try enabling http

# set deviceconfig system service disable-http no

#commit

Highlighted
L6 Presenter

yes that will resolve I missed "After some change" :smileyhappy:

Highlighted
L0 Member

I tried http, but the output was this:

Web Page Blocked

Access to the web page you were trying to visit has been blocked in accordance with company policy. Please contact your system administrator if you believe this is in error.

User: 192.168.86.167

URL: 192.168.2.2/

Category: private-ip-addresses

and that is strange....192.168.2.2 is the management IP address...

Highlighted
L6 Presenter

goto configure mode

set rulebase security rules new from any to any destination 192.168.2.2 action allow

move rulebase security rules new top

commit

Highlighted
L0 Member

Hi Panos,

I have solved with the rule "new" that you suggested. With this rule at top I am able to connect by HTTP and HTTPS.

The problem was that my customer, by himself, introduced a rule at  bottom like "deny any any any any...."

after the normal rules to log all traffic denied ("after some changes he said me"  :smileywink:  ). He said that in previous PANOS releases ( e.g. 4.1.8) this "deny all rule" worked fine....I don't know...but I suggest him to specify in the deny rule at least one source zone and not any.. any. What is your opinion ?

Thanks.

Regards

Lauro

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!