Skip to main content
TofD
TofD
New Member
Jun 9, 2023 1:00 PM UTC
Solved

Cannot access FortiAnalyzer WebGUI

Hi everyone,

 

I got a issue since yesterday on my FAZ : i cannot connect to webGUI anymore. When I try to connect to https://192.168.1.16 I get an ERR_CONNECTION_REFUSED in any web browser on any computer. It was working earlier. I did not make any changes on the interfaces.

 

Rebooting the FAZ has no effect. No host filtering on the interface or on admin account. SSH and PING keep on going on. allowaccess is set on https, ping, ssh, snmp, webservice and fgfm. Where could the problem be spotted ?

TofD
TofDAnswer
New Member
Jun 11, 2023 8:03 PM UTC

I have just found the solution : the issue was caused by the soc-fabric service who was using port 443, as the https service, there was a conflict between them.

I have changed the fabric port and managed to connect to https port.

View in thread

8 replies

abarushka
Staff
abarushka
Staff
Jun 9, 2023 2:27 PM UTC

Hello,

 

You may consider to sniff the traffic on PC or FAZ and check for anomalies (i.e. whether TCP/TLS session is established successfully).

    TofD
    TofDAuthor
    New Member
    Jun 11, 2023 5:08 PM UTC

    Seems nothing strange after sniffing traffic.

    srajeswaran
    Staff
    srajeswaran
    Staff
    Jun 11, 2023 6:40 AM UTC

    Can you run "exec lvm info" and confirm there is enough disk space left, seen similar issue due to disk issues. May need to increase the disk if the usage is high.

     

    https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Extending-disk-space-in-FortiAnalyzer-VM/ta-p/194365

      TofD
      TofDAuthor
      New Member
      Jun 11, 2023 5:07 PM UTC

      exec lvm info is not a recognized command on my FAZ.

      Weird if it is a disk space left issue, because my FAZ is brand new and set up since only about 2 months.
      Is there another command to check available space on FortiAnalyzer ?

      TofD
      TofDAuthor
      New Member
      Jun 11, 2023 7:34 PM UTC

      I ran the following command on CLI :

       

      # diag sniffer packet port1 "host 192.168.1.3 and port 443"

       

      And I get :


      interfaces=[port1]
      filters=[host 192.168.1.3 and port 443]
      8.939082 192.168.1.3.64618 -> 192.168.1.16.443: syn 3690057182
      8.939150 192.168.1.16.443 -> 192.168.1.3.64618: rst 0 ack 3690057183
      8.939161 192.168.1.3.64619 -> 192.168.1.16.443: syn 86725739
      8.939173 192.168.1.16.443 -> 192.168.1.3.64619: rst 0 ack 86725740
      9.200735 192.168.1.3.64620 -> 192.168.1.16.443: syn 2360303182
      9.200845 192.168.1.16.443 -> 192.168.1.3.64620: rst 0 ack 2360303183
      9.448350 192.168.1.3.64618 -> 192.168.1.16.443: syn 3690057182
      9.448427 192.168.1.16.443 -> 192.168.1.3.64618: rst 0 ack 3690057183
      9.448838 192.168.1.3.64619 -> 192.168.1.16.443: syn 86725739
      9.448914 192.168.1.16.443 -> 192.168.1.3.64619: rst 0 ack 86725740
      9.709874 192.168.1.3.64620 -> 192.168.1.16.443: syn 2360303182
      9.709931 192.168.1.16.443 -> 192.168.1.3.64620: rst 0 ack 2360303183
      9.956718 192.168.1.3.64619 -> 192.168.1.16.443: syn 86725739
      9.956797 192.168.1.16.443 -> 192.168.1.3.64619: rst 0 ack 86725740
      9.956808 192.168.1.3.64618 -> 192.168.1.16.443: syn 3690057182
      9.956819 192.168.1.16.443 -> 192.168.1.3.64618: rst 0 ack 3690057183
      10.218094 192.168.1.3.64620 -> 192.168.1.16.443: syn 2360303182
      10.218171 192.168.1.16.443 -> 192.168.1.3.64620: rst 0 ack 2360303183
      10.474734 192.168.1.3.64619 -> 192.168.1.16.443: syn 86725739
      10.474812 192.168.1.16.443 -> 192.168.1.3.64619: rst 0 ack 86725740
      10.474823 192.168.1.3.64618 -> 192.168.1.16.443: syn 3690057182
      10.474836 192.168.1.16.443 -> 192.168.1.3.64618: rst 0 ack 3690057183
      10.728138 192.168.1.3.64620 -> 192.168.1.16.443: syn 2360303182
      10.728235 192.168.1.16.443 -> 192.168.1.3.64620: rst 0 ack 2360303183
      10.991616 192.168.1.3.64618 -> 192.168.1.16.443: syn 3690057182
      10.991675 192.168.1.16.443 -> 192.168.1.3.64618: rst 0 ack 3690057183
      11.024823 192.168.1.3.64619 -> 192.168.1.16.443: syn 86725739
      11.024880 192.168.1.16.443 -> 192.168.1.3.64619: rst 0 ack 86725740
      11.235745 192.168.1.3.64620 -> 192.168.1.16.443: syn 2360303182
      11.235804 192.168.1.16.443 -> 192.168.1.3.64620: rst 0 ack 2360303183

       

      It seems my FAZ send a RST packet to the client, but i don't know why.

      TofD
      TofDAuthorAnswer
      New Member
      Jun 11, 2023 8:03 PM UTC

      I have just found the solution : the issue was caused by the soc-fabric service who was using port 443, as the https service, there was a conflict between them.

      I have changed the fabric port and managed to connect to https port.

        Thwe
        Thwe
        Visitor III
        Mar 8, 2024 2:57 AM UTC

        same issue at mine now.
        could you please help how to solve it

        Terms & ConditionsAccessibility statement
        Risk and Resilience in the Age of AI. An OT Thought Leadership Summit for Houston's Critical Infrastructure Leaders. Date: Thursday, December 3, 2026. Time: 8:30 am - 1:30 pm (CT). Location: The Westin Houston, Memorial City | 945 Gessner Road, Houston, TX 77024