management GUI issue

[lauro7]

Hi,

I have a PA-200 with PANOS 4.1.13.

After some changes in configuration and after a commit, I lost connection to the management interface and now it is impossible to connect by web GUI.

Only SSH CLI  is running. How can I check by CLI what happened ? The system services SSH, HTTPS and PING are enabled and all IP are permitted to connect to management interface. The system process mgmtsrvr is running and the group mgmt_service is running.

_

Thanks.

[panos]

try that

debug software restart web-server

[lauro7]

I have tried, but Web GUI is still not running.

[panos]

did you try restarting management also ?

debug software restart management-server

[lauro7]

Yes, I tried, but this is the output. I think it is for the cli connection lost.

But GUI is still not running.

Thanks.

____________________________________________________

Process 'mgmtsrvr' executing RESTART

Jul 11 12:30:26 Error: pan_read_full(comm_utils.c:97): srvr: fatal recv error. sock=3 err=Connection reset by peer (131)

admin@FW12003>

_____________________________________________________________________________

[UhMayYeah]

Two options:

1>You can reload the config version  that allowed  https

# load config version <version>

#commit

OR

2>Try enabling http

# set deviceconfig system service disable-http no

#commit

[panos]

yes that will resolve I missed "After some change"

[lauro7]

I tried http, but the output was this:

Web Page Blocked

Access to the web page you were trying to visit has been blocked in accordance with company policy. Please contact your system administrator if you believe this is in error.

User: 192.168.86.167

URL: 192.168.2.2/

Category: private-ip-addresses

and that is strange....192.168.2.2 is the management IP address...

[panos]

goto configure mode

set rulebase security rules new from any to any destination 192.168.2.2 action allow

move rulebase security rules new top

commit

[lauro7 · Accepted solution]

Hi Panos,

I have solved with the rule "new" that you suggested. With this rule at top I am able to connect by HTTP and HTTPS.

The problem was that my customer, by himself, introduced a rule at  bottom like "deny any any any any...."

after the normal rules to log all traffic denied ("after some changes he said me"    ). He said that in previous PANOS releases ( e.g. 4.1.8) this "deny all rule" worked fine....I don't know...but I suggest him to specify in the deny rule at least one source zone and not any.. any. What is your opinion ?

Thanks.

Regards

Lauro

[panos]

when using any any deny you should be careful not to disconnect any intra traffic so you should add intrazone allow rules.

trust trust allow

dmz dmz allow

any any deny

also you should check what you need to open for untrust to untrust and allow that also(tcp 443 , udp 500 etc..)