Description
This article describes how the GUI may stop working after an upgrade and how it can be fixed.
Scope
FortiGate.
Solution
- Check if the httpsd process is running on FortiGate using the following command. This command shows the process ID of the httpsd process:
diagnose sys process pidof httpsd
The above output will be empty.
Check if the HTTPSD shows up using the following command:
fnsysctl ls /var/run/
fnsysctl cat /var/run/https.pid
-
If HTTPSD does not show up, run a sniffer on FortiGate. FortiGate is responding with RST to the HTTPS request.
diagnose sniffer packet any "host <IP address>" 4 0 l
IP address: Source PC IP address from where the user is trying to access the FortiGate GUI.
-
Verify that HTTPS is enabled for the required interface using the following command:
show system interface <interface name>
config system interface
edit <interface name>
set allowaccess ping http https
end
-
Check if there is an admin-server-cert configured:
config system global
show full | grep server-cert
If it is not configured, configure it as follows:
config system global
set admin-server-cert Fortinet_Factory
end
After this, try accessing FortiGate via the GUI again, and it should work.
-
Check if the HTTPSD daemon consumes high CPU or memory or is in the 'D' State:
diagnose sys top 2 50
Run Time: 1 days, 22 hours and 0 minutes
0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 3962T, 2220F
httpsd 157 S 0.0 0.5 0
If the daemon 'httpsd' consumes more resources(cpu/memory), try to kill the process with:
fnsysctl killall httpsd
Or check process ID:
diagnose sys process pidof httpsd
Restart httpsd:
diagnose sys kill 11 <process-id>
Refer to Troubleshooting Tip: Unable to access FortiGate GUI because of high CPU due to httpsd process for further troubleshooting of the GUI issue due to httpsd consuming high CPU.
-
Run debug commands to troubleshoot the GUI access issue in depth:
diagnose debug reset
diagnose debug application httpsd -1
diagnose debug enable
Disable debugs with the following commands:
diagnose debug reset
diagnose debug disable
-
Try to change the admin access port to a different port to avoid any port conflict.
config system global
set admin-sport <port>
end
Note:
Starting from v7.6.1, GUI access can conflict with IPSec TCP tunnel on the same interface. This may affect GUI access for interfaces bound to an IPsec tunnel in the scenario that the GUI admin port is also using port 443. See the following document: GUI access conflict with IPSec TCP tunnel on the same interface.
