PANOS Release 6.1.3 Required to login twice to get access

[licenselu]

Hello,

I've a cluster of PA500 running 6.1.3.

When I try to login to the system (with the GUI), the login always fails and I'm redirected back to the login page.

After login again, it works fine...

Any idea ?

Regards,

HA

[prb]

Hi license@simac.lu

Did you check authd logs to see if the authentication is successful during the first attempt?

If you seeing nothing unusual, you might want to check if disk-space is almost full.

>show system disk-space

Thank You.

[licenselu]

Hello,

Filesystem            Size  Used Avail Use% Mounted on

/dev/sda3             3.8G  1.6G  2.1G  43% /

/dev/sda5             7.6G  3.5G  3.8G  49% /opt/pancfg

/dev/sda6             3.8G  1.6G  2.0G  45% /opt/panrepo

tmpfs                 459M   69M  390M  16% /dev/shm

/dev/sda8             125G  8.5G  110G   8% /opt/panlogs

So, the issue is not coming from the disk space...

Regards,

HA

[pulukas]

What does the system log show for the first failed login attempt?

[James_Costello]

Is the administrator account utilizing local authentication or an external source (LDAP, RADIUS, Kerberos)?

Do you experience the same issue when connecting via SSH or just the WEBUI?

[licenselu]

Hello,

Issue only with the Web GUI, SSH is OK.

In the log I can see two login attempt.

User xxx logged in via Web from y.y.y.y using https     04/29 15:13:35

User 'xxx' authenticated. From: y.y.y.y.                                             04/29 15:13:35

User xxx logged in via Web from y.y.y.y using https     04/29 15:11:44

User 'xxx' authenticated. From: y.y.y.y.                                              04/29 15:11:44

Regards,

HA

[James_Costello]

Does this occur with different browsers or just one in particular?

When you login are there multiple logins showing in the Logged in Admins widget on the Dashboard of the firewall?

The output above indicates that authentication was successful. What is the output from the authd.log when the two logins occur

from the CLI - tail lines 100 mp-log authd.log

[licenselu]

Hello,

I find the problem. Browser bookmark !

The bookmark was pointing to https://x.x.x.x/esp/login.esp

After removing the /esp/login.esp, no issue...

Thanks all for your help.

Regards,

HA

[James_Costello]

Good to hear you found the answer.

Have a good day

[pulukas]

Thanks for the update.  That is a strange issue.