| Context: In this scenario, the user has encountered problems accessing FortiManager/FortiAnalyzer through the GUI after a firmware upgrade. The message received in the browser is 'Connection_refused'. Access is established via the CLI, and the user ensures the device is working properly after the upgrade. Validation process: - Check the current administrator settings and confirm no changes were made, and that HTTPS access continues using port 443 and HTTP 80.
- Enable a packet capture in FortiManager/FortiAnalyzer using port 443 and confirm the packets are received to eliminate the possibility of a network issue.
- Verify that the correct upgrade path was applied correctly (from the latest 7.2 version to v7.4.10) (run diagnose cdb upgrade summary).
- Confirm there were no crashes related to the HTTP service (run diagnose debug crash read).
- Validate the current process list and status in process execution. In the current execution process, httpd is tagged as defunct, and checking the current process list shows httpd in a zombie status.
- Attempt to reset the httpd process and see whether the issue persists.
- In this example, the system resources were found in non-compliance with the minimum requirements of vCPU: there are only 2 vCPUs.
- After assigning 2 more vCPUs in the Hypervisor, the GUI session was established.
- If the resources are fine and the issue persists, perform the following:
- Unset HTTP/HTTPS administrative ports from the CLI.
config system admin setting unset http_port unset https_port end
- Unset the admin GUI certificate.
config system admin setting unset admin_server_cert end
- Reboot the device to allow the web service to start with default parameters.
Note: Some useful commands to use when troubleshooting GUI responses:
diagnose debug application gui 255
diagnose debug service httpd 255
diagnose debug service main 255 diagnose debug apache access-log
diagnose debug apache error-log Related documents: | 
