Fortigate60F , Unable to login Via Web Portal anymore. only CLI working

@AdilHamid 

As a first step you can verify from the CLI by running below commands if the traffic is reaching your FortiGate appliance or not when you access GUI

# diagnose sniffer packet any 'host <PCIP>" 4

Also please check if the HTTPS service is enabled on the respective interface under

"config system interface" -> "edit <interface>" -> "show"

Best Regards,

Hi there , I have tried the first command you sent me and once i put on the screen their is only > i can see , i have tried logging in again with https but no update screen is still the same

Sorry i have no experience in working in CLI so i may be doing something wrong

More Information is on the screen below , Firewall is working but only the web Interface stops working

Hi @AdilHamid 

run this command on your windows machine: ipconfig

copy your computer ip address and then use in sniffer : diagnose sniffer packet any 'host x.x.x.x' 4 0 l

replace x.x.x.x with your computer ip address

Regards

Rajan

@AdilHamid 

There is typo error in the command. 

Please find the right command

# diagnose sniffer packet any "host <PCIP>" 4

Note: Replace <PCIP> with your client machine IP from where you access FGT GUI.

I would request you to also check the Admin Access port for the GUI access, maybe its not the default 443.

Please also ugrade the Fimrware version to 7.2 or above as your current version is end of Eng Support. You can open a support case for upgrade recommendations.

Please also review some of the article describing initial troubleshooting for GUI access issues.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Cannot-access-the-FortiGate-web-admin/ta-p/190239

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Cannot-access-the-FortiGate-web-admin/ta-p/190239 

Best Regards,

@AdilHamid 

You firewall is listening on port 10443 and your interface configuration looks fine. Could you please also check the Local-In policy in Firewall is there for port 10443 and Fortinet Certificate is selected under config system global

To check for Local-in policy for port 10443 is available.

show firewall local-in-policy | grep 10443

Also make sure Fortinet-Factory certificate is selected under "config system global'

config system global
show | grep "admin"

Once these things are verified you can run debug using below commands and share it here.

diag debug reset
diag debug flow filter saddr 192.168.101.254
diag debug flow filter daddr 192.168.101.1
diag debug flow filter dport 10443
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug flow trace start 100
diag debug enable

Now try to connect to GUI from the PC 192.168.101.254 and after that you can disable debug using below command.

diag debug disable
diag debug reset

You just mentioned, you cannot connect SSH here. So how do you collect the logs? via console ?

If any of the above doesn't work you can upgrade Firmware using CLI by using TFTP method. below links will help you with steps.

Technical Tip: FortiGate TFTP Upgrade - Fortinet Community 

Technical Tip: How to upgrade the FortiGate firmwa... - Fortinet Community

Even after upgrade things doesn't go well, I would recommend you open a ticket with our Support team for assistance.

Best Regards

Hi there , 

please check below , I am not seeing any Certificate information below , let me know if there is any command to add this. see below

HGB-60F # show firewall local-in-policy | grep 10443

HGB-60F # show system global
config system global
set admin-https-redirect disable
set admin-port 8089
set admin-sport 10443
set alias "FortiGate-60F"
set gui-certificates enable
set gui-fortisandbox-cloud enable
set gui-ipv6 enable
set gui-theme neutrino
set gui-wireless-opensecurity enable
set hostname "HGB-60F"
set switch-controller enable
set timezone 25
end

HGB-60F # show | grep "admin"
#config-version=FGT60F-6.4.6-FW-build1879-210520:opmode=1:vdom=0:user=admin
set admin-https-redirect disable
set admin-port 8089
set admin-sport 10443
edit "prof_admin"
config system admin
edit "admin"
set accprofile "super_admin"
config system sso-admin
config system replacemsg admin "pre_admin-disclaimer-text"
config system replacemsg admin "post_admin-disclaimer-text"
config system replacemsg nac-quar "nac-quar-admin"
<p>Your network access has been restricted due to the detection of potentially malicious traffic. Please contact your network administrator for further information.</p>
set admin enable
set admin enable
set admin-login-logs enable

Hello AdilHamid,

Could you please check if the admin server certificate has been configured:

config sys global

set admin-server-cert Fortinet_Factory

end

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Cannot-access-the-FortiGate-web-admin/ta-p/190239