Unable to access PA-500 GUI "Creating Administrative Session"

[VAntonenko]

Hello,

Today, when i try to connect PA-500 user interface, after login, PA-500 WEB server shown (as usually) "Creating administrative session. Plase Wait..." for a while, and nothing happen. Chrome Browser shown "Page is not responding".

I tried to login with other browsers, from other PCs - not result.

I can access the CLI, i restarted web-server, mgmt-server - not result.

How can i troubleshoot and fix this issue, preferably without restarting the system.

Standalone PA-500

Software Version 5.0.6

[HULK]

Hello VAntonenko,

Could you please let us know the management-plane CPU utilization in this PAN firewall and current PAN OS version running on it. Did you confirm that the mgmt-server process restarted successfully and a new PID has been assigned to this process.

Example: STEP-1

1: admin@DADA> show system software status | match mgmt

Group    mgmt_services        running

Process  mgmtsrvr             running  (pid: 20528) >>>>>>>>>>>>>

2: admin@DADA> debug software restart management-server

3: admin@DADA> show system software status | match mgmt

Group    mgmt_services        running

Process  mgmtsrvr             running  (pid: 41256) >>>>>>>>>>>>> New PID (so the previous daemon has been restarted successfully)

STEP-2

Please verify, how many admin sessions are currently active on this firewall. You may clear all admin sessions and then try to access the GUI.

admin@DADA> show admins

Admin                           From   Client Session-start      Idle-for

--------------------------------------------------------------------------

admin                 192.168.1.100      CLI 10/29 05:54:26     00:00:00s

admin@DADA> delete admin-sessions

STEP-3

PLease share below mentioned command o/p.

admin@DADA> show system resources follow  >>>>>>> after apply this command press SHIFT+M

Hope this helps.

Thanks

[VAntonenko]

HULK, thank you for the reply.

STEP 1

admin@PA-500> show system software status | match mgmt

Group    mgmt_services        running

Process  mgmtsrvr             running  (pid: 32622)

Process  flow_mgmt      running  (pid: 868)

after restart

Group    mgmt_services        running

Process  mgmtsrvr             running  (pid: 1474) - changed, so, that means the service restarted succesfully

Process  flow_mgmt      running  (pid: 868)

STEP 2

show admins

Admin                           From   Client Session-start      Idle-for

--------------------------------------------------------------------------

Admin                  172.16.52.123      CLI 10/29 15:57:02     00:00:00s

Just me, through CLI

STEP 3

show system resources follow                  

top - 16:00:46 up 20 days,  2:27,  1 user,  load average: 0.06, 0.24, 0.17

Tasks:  92 total,   1 running,  91 sleeping,   0 stopped,   0 zombie

Cpu(s):  0.0%us,  0.3%sy,  0.0%ni, 99.7%id,  0.0%wa,  0.0%hi,  0.0%si,  0.0%st

Mem:   2028576k total,  1902816k used,   125760k free,   219612k buffers

Swap:  2212876k total,        0k used,  2212876k free,  1083648k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND

1474 root      20   0  314m 169m 8272 S    0  8.6   1:22.86 mgmtsrvr

2516 root      20   0  284m  79m 6340 S    0  4.0   4:49.19 logrcvr

15559 root      20   0  175m  78m  67m S    0  4.0   0:02.63 useridd

2504 root      20   0  174m  53m  13m S    0  2.7   8:32.11 devsrvr

14406 nobody    20   0  202m  45m 9.8m S    0  2.3   0:24.91 appweb3

1807 admin     20   0 97732  22m  11m S    0  1.1   0:02.77 cli

2526 root      20   0  157m  20m 9664 S    0  1.0   8:44.57 routed

2521 root      20   0  108m  14m 6244 S    0  0.7   0:08.28 satd

2511 nobody    20   0  115m  14m 7440 S    0  0.7   0:32.69 appweb3

2333 root      20   0 91368  13m 6316 S    0  0.7   0:02.69 dagger

2537 nobody    20   0  121m  13m 7876 S    0  0.7   0:49.17 appweb3

2308 root       0 -20 63908  11m 4936 S    0  0.6  34:14.02 masterd_core

2519 root      20   0  247m  11m 5552 S    0  0.6   1:47.01 varrcvr

2327 root       0 -20 32360  10m 3316 S    0  0.5  74:28.66 masterd_manager

2335 root      20   0 78428  10m 5584 S    0  0.5   0:01.78 cryptod

2527 root      20   0  129m  10m 6144 S    0  0.5   0:03.89 authd

2524 root      20   0 73664  10m 5464 S    0  0.5   0:00.83 dnsproxyd

2525 root      20   0 74460 9912 5264 S    0  0.5   0:01.32 pppoed

2515 root      20   0 90652 9792 5860 S    0  0.5   0:01.17 ikemgr

2522 root      20   0  100m 9420 5396 S    0  0.5   0:00.69 sslmgr

2523 root      20   0 56196 9108 5296 S    0  0.4   0:00.79 dhcpd

2517 root      20   0 99684 9096 5592 S    0  0.4   0:00.56 rasmgr

2336 root      20   0  166m 8912 4980 S    0  0.4   4:23.82 sysdagent

2520 root      17  -3 56492 8676 5208 S    0  0.4   1:00.85 ha_agent

---------------------

show system info

hostname: PA-500

ip-address: X.X.X.X

netmask: X.X.X.X

default-gateway: X.X.X.X

ipv6-address:

ipv6-link-local-address: XXXX

ipv6-default-gateway:

mac-address: x:x:x:x:x:x

time: Wed Oct 29 16:03:29 2014

uptime: 20 days, 2:28:33

family: 500

model: PA-500

serial: xxxxxxxx

sw-version: 5.0.6

global-protect-client-package-version: 0.0.0

app-version: 320-1459

app-release-date: unknown

av-version: 0

av-release-date: unknown

threat-version: 0

threat-release-date: unknown

wildfire-version: 0

wildfire-release-date: unknown

url-filtering-version: 0

global-protect-datafile-version: 0

global-protect-datafile-release-date: unknown

logdb-version: 5.0.2

platform-family: 500

logger_mode: False

vpn-disable-mode: off

operational-mode: normal

multi-vsys: off

[HULK]

Hello VAntonenko

Are you facing this problem for both HTTP and HTTPS connections. If you are trying to access only through HTTPS, then i would request you to access through HTTP (to avoid any certificate problem) and let us know the result.

Example to enable HTTP: From CLI:

1. Enter configuration mode.admin@PA-2020> configure <enter>Entering configuration mode[edit]
2. Enter the following command from CLI:admin@PA-2020# set deviceconfig system service disable-http no <enter>admin@PA-2020# commit <enter>
3. Log on to WebUI (via HTTP), un-check HTTPS & Commit (Commit from WebUI)
4. Logon to WebUI (via HTTP) CHECK HTTPS & Commit (Commit from WebUI)
5. Disable HTTP as follows:admin@PA-2020# set deviceconfig system service disable-http yes <enter>admin@PA-2020# commit <enter>

Thanks

[VAntonenko]

Thanks, HULK,

1. Enabled http access, but unable to logon through http

2. Disabled https access, and still unable to logon through http

Notice, than i access CLI through SSH.

Now i planning maintenance window tomorrow, for full restart PA-500. I hope this help.

[panos · Accepted solution]

I agree , reboot is a good decision.

[HULK]

Hello VAntonenko,

One last try before reboot this FW. Could you please try to run WEB-UI debug, if that shows any key information here. Open a new tab in the same browser and navigate to https://<ip address of your PAN FW>/debug.

Thanks

[HULK]

Hello VAntonenko

Did you try with all browsers and the result remains the same...? (Google-chrome, IE, firefox)

Is there any core file on this firewall..? You may run a CLI command "admin> show system files"

Thanks

[VAntonenko]

HULK,

Last record in debug console was made 27-Oct-2014 07:48 UTC, but now time on device is 29-Oct-13:18:50 UTC.

<Previous entries cut>

[27-Oct-2014 07:47:15 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:15 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:18 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:18 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:21 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:21 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:24 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:24 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:27 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:27 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:30 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:30 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:33 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:33 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:36 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:36 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:39 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:39 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:42 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:42 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:45 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:45 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:48 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:48 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:51 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:51 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:54 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:54 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:47:57 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:47:57 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:00 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:48:00 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:03 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:48:03 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:06 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:48:06 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:09 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:48:09 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:12 UTC] Call to [PanDirect.pollJob] from router.php

[27-Oct-2014 07:48:12 UTC] Call to [PanDirect.pollJob] from router.php took 0.1ms

[27-Oct-2014 07:48:13 UTC] Call to [PanDirect.execute] from router.php

[27-Oct-2014 07:48:13 UTC] Call to [PanDirect.getContextVariables] from router.php

[27-Oct-2014 07:48:13 UTC] Call to [PanDirect.getConfigChangePending] from router.php

[27-Oct-2014 07:48:14 UTC] Call to [PanDirect.getConfigChangePending] from router.php took 0.3ms

[27-Oct-2014 07:48:14 UTC] Call to [PanDirect.execute] from router.php took 0.6ms

[27-Oct-2014 07:48:15 UTC] Call to [PanDirect.getContextVariables] from router.php took 2.1ms

< End of Debug Console>

Thanks

[HULK]

1. Hit the 'Clear debug' button - to clear any existing debug on the screen
2. Select 'Debug' check box to enable debug and uncheck 'Minimize Javascript'.
3. Try to access the firewall through HTTPS/HTTP.

Thanks

[VAntonenko]

On different browsers, the result has little difference.

IE - After "Creating administrative session", shows blue blank page. with adress "http://<My device IP>/#dashboard::vsys1", with hostname in title, and favicon.

Opera, Firefox, Chrome - scenario is not responding:

"http://172.16.52.125/js/3rdParty/ext/ext-all.js?__version=1372894957 line 7 > Function:1"

show system files

/var/cores/:

total 4.0K

drwxrwxrwx 2 root root 4.0K Sep  9 07:37 crashinfo

/var/cores/crashinfo:

total 0

/opt/dpfs/var/cores/:

total 4.0K

drwxrwxrwx 2 root root 4.0K Sep  9 07:40 crashinfo

/opt/dpfs/var/cores/crashinfo:

total 0