Unable to access PA-500 GUI "Creating Administrative Session"

VAntonenko · ‎10-29-2014

Hello,

Today, when i try to connect PA-500 user interface, after login, PA-500 WEB server shown (as usually) "Creating administrative session. Plase Wait..." for a while, and nothing happen. Chrome Browser shown "Page is not responding".

I tried to login with other browsers, from other PCs - not result.

I can access the CLI, i restarted web-server, mgmt-server - not result.

How can i troubleshoot and fix this issue, preferably without restarting the system.

Standalone PA-500

Software Version 5.0.6

panos · ‎10-29-2014

I agree , reboot is a good decision.

View solution in original post

HULK · ‎10-29-2014

Hello VAntonenko,

Could you please let us know the management-plane CPU utilization in this PAN firewall and current PAN OS version running on it. Did you confirm that the mgmt-server process restarted successfully and a new PID has been assigned to this process.

Example: STEP-1

1: admin@DADA> show system software status | match mgmt

Group mgmt_services running

Process mgmtsrvr running (pid: 20528) >>>>>>>>>>>>>

2: admin@DADA> debug software restart management-server

3: admin@DADA> show system software status | match mgmt

Group mgmt_services running

Process mgmtsrvr running (pid: 41256) >>>>>>>>>>>>> New PID (so the previous daemon has been restarted successfully)

STEP-2

Please verify, how many admin sessions are currently active on this firewall. You may clear all admin sessions and then try to access the GUI.

admin@DADA> show admins

Admin From Client Session-start Idle-for

--------------------------------------------------------------------------

admin 192.168.1.100 CLI 10/29 05:54:26 00:00:00s

admin@DADA> delete admin-sessions

STEP-3

PLease share below mentioned command o/p.

admin@DADA> show system resources follow >>>>>>> after apply this command press SHIFT+M

Hope this helps.

Thanks

VAntonenko · ‎10-29-2014

HULK, thank you for the reply.

STEP 1

admin@PA-500> show system software status | match mgmt

Group mgmt_services running

Process mgmtsrvr running (pid: 32622)

Process flow_mgmt running (pid: 868)

after restart

Group mgmt_services running

Process mgmtsrvr running (pid: 1474) - changed, so, that means the service restarted succesfully

Process flow_mgmt running (pid: 868)

STEP 2

show admins

Admin From Client Session-start Idle-for

--------------------------------------------------------------------------

Admin 172.16.52.123 CLI 10/29 15:57:02 00:00:00s

Just me, through CLI

STEP 3

show system resources follow

top - 16:00:46 up 20 days, 2:27, 1 user, load average: 0.06, 0.24, 0.17

Tasks: 92 total, 1 running, 91 sleeping, 0 stopped, 0 zombie

Cpu(s): 0.0%us, 0.3%sy, 0.0%ni, 99.7%id, 0.0%wa, 0.0%hi, 0.0%si, 0.0%st

Mem: 2028576k total, 1902816k used, 125760k free, 219612k buffers

Swap: 2212876k total, 0k used, 2212876k free, 1083648k cached

PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND

1474 root 20 0 314m 169m 8272 S 0 8.6 1:22.86 mgmtsrvr

2516 root 20 0 284m 79m 6340 S 0 4.0 4:49.19 logrcvr

15559 root 20 0 175m 78m 67m S 0 4.0 0:02.63 useridd

2504 root 20 0 174m 53m 13m S 0 2.7 8:32.11 devsrvr

14406 nobody 20 0 202m 45m 9.8m S 0 2.3 0:24.91 appweb3

1807 admin 20 0 97732 22m 11m S 0 1.1 0:02.77 cli

2526 root 20 0 157m 20m 9664 S 0 1.0 8:44.57 routed

2521 root 20 0 108m 14m 6244 S 0 0.7 0:08.28 satd

2511 nobody 20 0 115m 14m 7440 S 0 0.7 0:32.69 appweb3

2333 root 20 0 91368 13m 6316 S 0 0.7 0:02.69 dagger

2537 nobody 20 0 121m 13m 7876 S 0 0.7 0:49.17 appweb3

2308 root 0 -20 63908 11m 4936 S 0 0.6 34:14.02 masterd_core

2519 root 20 0 247m 11m 5552 S 0 0.6 1:47.01 varrcvr

2327 root 0 -20 32360 10m 3316 S 0 0.5 74:28.66 masterd_manager

2335 root 20 0 78428 10m 5584 S 0 0.5 0:01.78 cryptod

2527 root 20 0 129m 10m 6144 S 0 0.5 0:03.89 authd

2524 root 20 0 73664 10m 5464 S 0 0.5 0:00.83 dnsproxyd

2525 root 20 0 74460 9912 5264 S 0 0.5 0:01.32 pppoed

2515 root 20 0 90652 9792 5860 S 0 0.5 0:01.17 ikemgr

2522 root 20 0 100m 9420 5396 S 0 0.5 0:00.69 sslmgr

2523 root 20 0 56196 9108 5296 S 0 0.4 0:00.79 dhcpd

2517 root 20 0 99684 9096 5592 S 0 0.4 0:00.56 rasmgr

2336 root 20 0 166m 8912 4980 S 0 0.4 4:23.82 sysdagent

2520 root 17 -3 56492 8676 5208 S 0 0.4 1:00.85 ha_agent

---------------------

show system info

hostname: PA-500

ip-address: X.X.X.X

netmask: X.X.X.X

default-gateway: X.X.X.X

ipv6-address:

ipv6-link-local-address: XXXX

ipv6-default-gateway:

mac-address: x:x:x:x:x:x

time: Wed Oct 29 16:03:29 2014

uptime: 20 days, 2:28:33

family: 500

model: PA-500

serial: xxxxxxxx

sw-version: 5.0.6

global-protect-client-package-version: 0.0.0

app-version: 320-1459

app-release-date: unknown

av-version: 0

av-release-date: unknown

threat-version: 0

threat-release-date: unknown

wildfire-version: 0

wildfire-release-date: unknown

url-filtering-version: 0

global-protect-datafile-version: 0

global-protect-datafile-release-date: unknown

logdb-version: 5.0.2

platform-family: 500

logger_mode: False

vpn-disable-mode: off

operational-mode: normal

multi-vsys: off

HULK · ‎10-29-2014

Hello VAntonenko

Are you facing this problem for both HTTP and HTTPS connections. If you are trying to access only through HTTPS, then i would request you to access through HTTP (to avoid any certificate problem) and let us know the result.

Example to enable HTTP: From CLI:

Enter configuration mode.admin@PA-2020> configure <enter>Entering configuration mode[edit]
Enter the following command from CLI:admin@PA-2020# set deviceconfig system service disable-http no <enter>admin@PA-2020# commit <enter>
Log on to WebUI (via HTTP), un-check HTTPS & Commit (Commit from WebUI)
Logon to WebUI (via HTTP) CHECK HTTPS & Commit (Commit from WebUI)
Disable HTTP as follows:admin@PA-2020# set deviceconfig system service disable-http yes <enter>admin@PA-2020# commit <enter>

Thanks

VAntonenko · ‎10-29-2014

Thanks, HULK,

1. Enabled http access, but unable to logon through http

2. Disabled https access, and still unable to logon through http

Notice, than i access CLI through SSH.

Now i planning maintenance window tomorrow, for full restart PA-500. I hope this help.

panos · ‎10-29-2014

I agree , reboot is a good decision.

HULK · ‎10-29-2014

Hello VAntonenko,

One last try before reboot this FW. Could you please try to run WEB-UI debug, if that shows any key information here. Open a new tab in the same browser and navigate to https://<ip address of your PAN FW>/debug.

Thanks

HULK · ‎10-29-2014

Hello VAntonenko

Did you try with all browsers and the result remains the same...? (Google-chrome, IE, firefox)

Is there any core file on this firewall..? You may run a CLI command "admin> show system files"

Thanks

VAntonenko · ‎10-29-2014

HULK,

Last record in debug console was made 27-Oct-2014 07:48 UTC, but now time on device is 29-Oct-13:18:50 UTC.

[27-Oct-2014 07:47:15 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:15 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:18 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:18 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:21 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:21 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:24 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:24 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:27 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:27 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:30 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:30 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:33 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:33 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:36 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:36 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:39 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:39 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:42 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:42 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:45 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:45 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:48 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:48 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:51 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:51 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:54 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:54 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:57 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:57 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:00 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:48:00 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:03 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:48:03 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:06 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:48:06 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:09 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:48:09 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:12 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:48:12 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:13 UTC] Call to [PanDirect.execute] from router.php

[27-Oct-2014 07:48:13 UTC] Call to [PanDirect.getContextVariables] from router.php

[27-Oct-2014 07:48:13 UTC] Call to [PanDirect.getConfigChangePending] from router.php

[27-Oct-2014 07:48:14 UTC] Call to [PanDirect.getConfigChangePending] from router.php took 0.3ms

[27-Oct-2014 07:48:14 UTC] Call to [PanDirect.execute] from router.php took 0.6ms

[27-Oct-2014 07:48:15 UTC] Call to [PanDirect.getContextVariables] from router.php took 2.1ms

< End of Debug Console>

Thanks

HULK · ‎10-29-2014

Hit the 'Clear debug' button - to clear any existing debug on the screen
Select 'Debug' check box to enable debug and uncheck 'Minimize Javascript'.
Try to access the firewall through HTTPS/HTTP.

Thanks

VAntonenko · ‎10-29-2014

On different browsers, the result has little difference.

IE - After "Creating administrative session", shows blue blank page. with adress "http://<My device IP>/#dashboard::vsys1", with hostname in title, and favicon.

Opera, Firefox, Chrome - scenario is not responding:

"http://172.16.52.125/js/3rdParty/ext/ext-all.js?__version=1372894957 line 7 > Function:1"

show system files

/var/cores/:

total 4.0K

drwxrwxrwx 2 root root 4.0K Sep 9 07:37 crashinfo

/var/cores/crashinfo:

total 0

/opt/dpfs/var/cores/:

total 4.0K

drwxrwxrwx 2 root root 4.0K Sep 9 07:40 crashinfo

/opt/dpfs/var/cores/crashinfo:

total 0

Unlock your full community experience!

Unable to access PA-500 GUI "Creating Administrative Session"

Unable to access PA-500 GUI "Creating Administrative Session"

Show your appreciation!