Technical Tip: Initial troubleshooting for GUI or CLI access issue

To check the GUI or CLI access issues:

1. Gain console access to the FortiGate and check the management IP address (that is trying to be accessed) and make sure the correct IP address is used.

show system interface

2. Run the below command to check the port numbers configured for HTTP, HTTPS, SSH, and Telnet access, respectively, and make sure the correct one is used:

    

config system global

show full-configuration | grep 'set admin-\(port\|sport\|ssh-port\|telnet-port\)'
    set admin-port 80
    set admin-sport 443
    set admin-ssh-port 22
    set admin-telnet-port 23

Check if the above administrative accesses are enabled at the interface level:

show system interface
    config system interface
        edit "mgmt1"
            set allowaccess ping https ssh http <----- Telnet does not need to be enabled unless necessary for testing purposes.

3. Run the below command to check if the source IP address is part of the trusted host configuration, if any is configured:

show system admin

Note:

Check if the user IP address is getting S-NAT before reaching FortiGate. If yes, make sure that the IP address is part of the trusted host list.

4. Run the commands below to check if the source IP address is allowed in the local-in policy if configured:

show firewall local-in-policy

5. Take the debug flow and packet sniffer if the issue still exists, to check for errors:

Debug:

diagnose debug reset
diagnose debug app httpsd -1 <-- For GUI access
diagnose debug app sshd -1 <-- For CLI access (SSH)
diagnose debug flow filter addr <Client_Source_IP>
diagnose debug flow show function-name enable

diagnose debug console timestamp enable
diagnose debug flow trace start 100
diagnose debug enable

Attempt to connect from the client.

diagnose debug disable
diagnose debug reset

Sniffer:

diagnose sniffer packet any "host <Client_Source_IP>" 6 0 a

Attempt to connect from the client. Press Ctrl+C to stop the capture.

6. Collect the Chrome debugger as mentioned in Technical Tip: Fortinet Support Tool - Google Chrome Extension for troubleshooting GUI issues.

    

7. Restart the httpsd daemon using fnsysctl killall -11 httpsd.

    

8. Try changing the Admin access port to a custom port to avoid any port conflict with the default port 443.

    

config system global

    set admin-sport <port>

end

9. If the firmware is v7.6.1 or above, check the IPSec tunnel IKE TCP port. 

    

show system settings | grep ike-tcp

Starting from v7.6.1, GUI access may conflict with the IPSec tunnel IKE TCP port for interfaces bound to an IPsec tunnel where the GUI admin port is also using port 443. See the document for the GUI access conflict with IPSec TCP tunnel on the same interface.

A possible list of causes of the issue is covered in Troubleshooting Tip: Cannot access the FortiGate web admin.