management GUI issue

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

management GUI issue

L0 Member

Hi,

I have a PA-200 with PANOS 4.1.13.

After some changes in configuration and after a commit, I lost connection to the management interface and now it is impossible to connect by web GUI.

Only SSH CLI  is running. How can I check by CLI what happened ? The system services SSH, HTTPS and PING are enabled and all IP are permitted to connect to management interface. The system process mgmtsrvr is running and the group mgmt_service is running.

_

Thanks.

1 accepted solution

Accepted Solutions

Hi Panos,

I have solved with the rule "new" that you suggested. With this rule at top I am able to connect by HTTP and HTTPS.

The problem was that my customer, by himself, introduced a rule at  bottom like "deny any any any any...."

after the normal rules to log all traffic denied ("after some changes he said me"  Smiley Wink  ). He said that in previous PANOS releases ( e.g. 4.1.8) this "deny all rule" worked fine....I don't know...but I suggest him to specify in the deny rule at least one source zone and not any.. any. What is your opinion ?

Thanks.

Regards

Lauro

View solution in original post

10 REPLIES 10

L6 Presenter

try that

debug software restart web-server

I have tried, but Web GUI is still not running.

did you try restarting management also ?

debug software restart management-server

Yes, I tried, but this is the output. I think it is for the cli connection lost.

But GUI is still not running.

Thanks.

____________________________________________________

Process 'mgmtsrvr' executing RESTART

Jul 11 12:30:26 Error: pan_read_full(comm_utils.c:97): srvr: fatal recv error. sock=3 err=Connection reset by peer (131)

admin@FW12003>

_____________________________________________________________________________

L5 Sessionator

Two options:

1>You can reload the config version  that allowed  https

# load config version <version>

#commit

OR

2>Try enabling http

# set deviceconfig system service disable-http no

#commit

yes that will resolve I missed "After some change" Smiley Happy

I tried http, but the output was this:

Web Page Blocked

Access to the web page you were trying to visit has been blocked in accordance with company policy. Please contact your system administrator if you believe this is in error.

User: 192.168.86.167

URL: 192.168.2.2/

Category: private-ip-addresses

and that is strange....192.168.2.2 is the management IP address...

goto configure mode

set rulebase security rules new from any to any destination 192.168.2.2 action allow

move rulebase security rules new top

commit

Hi Panos,

I have solved with the rule "new" that you suggested. With this rule at top I am able to connect by HTTP and HTTPS.

The problem was that my customer, by himself, introduced a rule at  bottom like "deny any any any any...."

after the normal rules to log all traffic denied ("after some changes he said me"  Smiley Wink  ). He said that in previous PANOS releases ( e.g. 4.1.8) this "deny all rule" worked fine....I don't know...but I suggest him to specify in the deny rule at least one source zone and not any.. any. What is your opinion ?

Thanks.

Regards

Lauro

when using any any deny you should be careful not to disconnect any intra traffic so you should add intrazone allow rules.

trust trust allow

dmz dmz allow

any any deny

also you should check what you need to open for untrust to untrust and allow that also(tcp 443 , udp 500 etc..)

  • 1 accepted solution
  • 5701 Views
  • 10 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!