Description
This article describes how the GUI may stop working after an upgrade and how it can be fixed.
Scope
FortiGate.
Solution
Check if the httpsd process is running on FortiGate using the following command. This command shows the process ID of the httpsd process:
diagnose sys process pidof httpsd
The above output will be empty.
Check if the HTTPSD shows up using the following command:
fnsysctl ls /var/run/
fnsysctl cat /var/run/https.pid
If HTTPSD does not show up, run a sniffer on FortiGate. FortiGate is responding with RST to the HTTPS request.
diagnose sniffer packet any "host <IP address>" 4 0 l
IP address: Source PC IP address from where the user is trying to access the FortiGate GUI.
Check if there is an admin-server-cert configured:
config system global
show full | grep server-cert
If it is not configured, configure it as follows:
config system global
set admin-server-cert Fortinet_Factory
end
After this, try accessing FortiGate via the GUI again and it should work.
Check if the HTTPSD daemon consumes high CPU or memory or is in the 'D' State:
diagnose sys top 2 50
Run Time: 1 days, 22 hours and 0 minutes
0U, 0N, 0S, 100I, 0WA, 0HI, 0SI, 0ST; 3962T, 2220F
httpsd 157 S 0.0 0.5 0
If the daemon 'httpsd' consumes more resources(cpu/memory), try to kill the process with:
diagnose sys kill 11 <process-id>
Debug command to troubleshoot the GUI access issue in depth:
diagnose debug reset
diagnose debug application httpsd -1
diagnose debug enable
Disable debugs with the following commands:
diagnose debug reset
diagnose debug disable
Note:
Starting from v7.6.4, GUI access can conflict with IPSec TCP tunnel on the same interface. This may affect GUI access for interfaces bound to an IPsec tunnel in the scenario that the GUI admin port is also using port 443. See the following document: GUI access conflict with IPSec TCP tunnel on the same interface
