Cisco Switch Web Interface Blocked, kinda.

[jcarlilesiu]

I am pulling my hair out (what little I have left).  I recently upgraded subscriptions with FTG for web filtering.  When I did, I could no longer access my Cisco switch web interface.  Full disclosure, I am a novice. 

The swtich is passing traffic, and I can see it as an Device Asset, with an assigned IP (which I have set as static), as well as the identified MAC address for the device. 

I however could not get the web interface to connect since upgrading the web filtering.  I went ahead and used the MAC address to assign it a Static IP in the FTG on the internal interface.  (the IP was set on the cisco before we lost our ability to connect). 

The device is listed as an asset, but from the DHCP page, it doesn't show the IP as registered, reserved, nothing.  Just missing.  I can't connect to it from our file serve computer using Chrome or Safari (mac environment).  Curious, I used another work station on the same subnet as all the rest (including the file server) and Chrome also couldn't connect.  Curious, I opened a safari window and punched in the reserved IP for the switch.  Wouldn't you know, I was presented with the login screen.  What?!  I was able to log in without issue.  

The file server computer is where I do most of my configuration and work related to IT services.  I really need it to work there.  Also doesn't explain why on the other workstation, it is able to see the switch using Safari but not Chrome. 

DNS issue?  What is going on!  Any help is appreciated. 

[funkylicious]

can you share the error for the webui that you get when trying to access the switch ?

if you have a firewall rule that does webfiltering LAN-X to LAN-Y that hits when you access the webui, just create a more specific HOST-X to HOST-Y above it and have no UTM profiles enabled to bypass/disable the webfilter/inspection.

L.E. how did you upgrade the webfiltering subscription, from what to what ?

[jcarlilesiu]

Thanks Funky.  

I should have said I renewed our Web Filtering subscription, not that we upgraded it.  It had expired though. 

This is the page from chrome trying both http and https access to the web interface. 

This site can’t be reached
10.3.1.2 took too long to respond.
Try:

Checking the connection
Checking the proxy and the firewall
ERR_CONNECTION_TIMED_OUT

I am not understanding your suggestion.  I realize you want me to make a new firewall policy, but the computer that can't connect to the switch are on the same LAN and subnet (internal).  The workstation I CAN access the web interface from is also on the same subnet, and it can access from Safari but not Chrome. 

[funkylicious]

if they are in the same subnet, the webfiltering isnt doing nothing since traffic is not even reaching the firewall.

appears to be a browser issue if Chrome doesnt work but Safari does.

the license renewal its only a coincidence in my opinion. if you can ping / ssh to the switch, then try a no ip http server and then re-enable it.

[jcarlilesiu]

From the file server computer, the PING fails (and both Chrome and Safari can't reach it).  From the other workstation, PING is successful and Safari can login but Chrome can not with the same error. 

I agree, it seems like a browser issue, except browsers on two different computers both in the same subnet as the switch behave differently. 

[jcarlilesiu]

Ok. I give up.  Who is an expert in this?  I need help.  Ill pay.  I can't figure this out, and I am done trying to resolve on my own. 

[Colin2]

Hi @jcarlilesiu ,

I can help you sort this out.
I have worked with Cisco gear and Forti web filtering in mixed Mac environments.
This looks like a mix of local routing, ARP, and browser level issues more than DNS.
Happy to take a look remotely and walk you through it.

You can reach out to me on my email here

Colin

[jcarlilesiu]

Thanks Collin. 

I actually got it figured out.  Took coming into the office on a Saturday when people weren't interrupting me all day. 

Just had to get into the new switch and modify the startup config so it stopped confusing the DHCP server with two switches of the same name... even though MACs are different. 

I appreciate the offer.  Im all set.  

One question if you don't mind though, I do have a question.  I connected switch 1 with a CAT6 to the new switch.  All vlans are on the port (default trunk) and passing traffic, assigning IPs, working as normal.  

Do I need to tag ports to trunk Vlans independently?  Meaning, with internal1, vlan43, and vlan100 all connected from one switch to another on their own dedicated port using "port to vlan" to tag them? 

We aren't a big office.  Total ports on each switch is about 35, mixture of computers and VOIP devices.  

Should separate or 1 port daisy chain is ok?