Cannot access FortiAnalyzer WebGUI

[TofD]

Hi everyone,

I got a issue since yesterday on my FAZ : i cannot connect to webGUI anymore. When I try to connect to https://192.168.1.16 I get an ERR_CONNECTION_REFUSED in any web browser on any computer. It was working earlier. I did not make any changes on the interfaces.

Rebooting the FAZ has no effect. No host filtering on the interface or on admin account. SSH and PING keep on going on. allowaccess is set on https, ping, ssh, snmp, webservice and fgfm. Where could the problem be spotted ?

[abarushka]

Hello,

You may consider to sniff the traffic on PC or FAZ and check for anomalies (i.e. whether TCP/TLS session is established successfully).

[TofD]

Seems nothing strange after sniffing traffic.

[srajeswaran]

Can you run "exec lvm info" and confirm there is enough disk space left, seen similar issue due to disk issues. May need to increase the disk if the usage is high.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Extending-disk-space-in-FortiAnalyzer-...

[TofD]

exec lvm info is not a recognized command on my FAZ.

Weird if it is a disk space left issue, because my FAZ is brand new and set up since only about 2 months.
Is there another command to check available space on FortiAnalyzer ?

[TofD]

I just find this, and it seems there is no available space issue :

# diagnose system print df
Filesystem 1K-blocks Used Available Use% Mounted on
rootfs 4010100 1637704 2372396 41% /
none 4010116 0 4010116 0% /dev
none 7407768 24 7407744 0% /dev/shm
none 65536 64 65472 0% /tmp
/dev/sda1 1007512 351488 656024 35% /data
/dev/md/mda 1921673480 81822872 1839834224 4% /var
/dev/md/mda 1921673480 81822872 1839834224 4% /drive0
/dev/md/mda 1921673480 81822872 1839834224 4% /Storage
/dev/loop0 8887 97 8278 1% /var/dm/tcl-root

[TofD]

I ran the following command on CLI :

# diag sniffer packet port1 "host 192.168.1.3 and port 443"

And I get :

interfaces=[port1]
filters=[host 192.168.1.3 and port 443]
8.939082 192.168.1.3.64618 -> 192.168.1.16.443: syn 3690057182
8.939150 192.168.1.16.443 -> 192.168.1.3.64618: rst 0 ack 3690057183
8.939161 192.168.1.3.64619 -> 192.168.1.16.443: syn 86725739
8.939173 192.168.1.16.443 -> 192.168.1.3.64619: rst 0 ack 86725740
9.200735 192.168.1.3.64620 -> 192.168.1.16.443: syn 2360303182
9.200845 192.168.1.16.443 -> 192.168.1.3.64620: rst 0 ack 2360303183
9.448350 192.168.1.3.64618 -> 192.168.1.16.443: syn 3690057182
9.448427 192.168.1.16.443 -> 192.168.1.3.64618: rst 0 ack 3690057183
9.448838 192.168.1.3.64619 -> 192.168.1.16.443: syn 86725739
9.448914 192.168.1.16.443 -> 192.168.1.3.64619: rst 0 ack 86725740
9.709874 192.168.1.3.64620 -> 192.168.1.16.443: syn 2360303182
9.709931 192.168.1.16.443 -> 192.168.1.3.64620: rst 0 ack 2360303183
9.956718 192.168.1.3.64619 -> 192.168.1.16.443: syn 86725739
9.956797 192.168.1.16.443 -> 192.168.1.3.64619: rst 0 ack 86725740
9.956808 192.168.1.3.64618 -> 192.168.1.16.443: syn 3690057182
9.956819 192.168.1.16.443 -> 192.168.1.3.64618: rst 0 ack 3690057183
10.218094 192.168.1.3.64620 -> 192.168.1.16.443: syn 2360303182
10.218171 192.168.1.16.443 -> 192.168.1.3.64620: rst 0 ack 2360303183
10.474734 192.168.1.3.64619 -> 192.168.1.16.443: syn 86725739
10.474812 192.168.1.16.443 -> 192.168.1.3.64619: rst 0 ack 86725740
10.474823 192.168.1.3.64618 -> 192.168.1.16.443: syn 3690057182
10.474836 192.168.1.16.443 -> 192.168.1.3.64618: rst 0 ack 3690057183
10.728138 192.168.1.3.64620 -> 192.168.1.16.443: syn 2360303182
10.728235 192.168.1.16.443 -> 192.168.1.3.64620: rst 0 ack 2360303183
10.991616 192.168.1.3.64618 -> 192.168.1.16.443: syn 3690057182
10.991675 192.168.1.16.443 -> 192.168.1.3.64618: rst 0 ack 3690057183
11.024823 192.168.1.3.64619 -> 192.168.1.16.443: syn 86725739
11.024880 192.168.1.16.443 -> 192.168.1.3.64619: rst 0 ack 86725740
11.235745 192.168.1.3.64620 -> 192.168.1.16.443: syn 2360303182
11.235804 192.168.1.16.443 -> 192.168.1.3.64620: rst 0 ack 2360303183

It seems my FAZ send a RST packet to the client, but i don't know why.

[TofD · Accepted solution]

I have just found the solution : the issue was caused by the soc-fabric service who was using port 443, as the https service, there was a conflict between them.

I have changed the fabric port and managed to connect to https port.

[Thwe]

same issue at mine now.
could you please help how to solve it