Gaia has introduced an all-new Portal that provides full access to system configuration.
Gaia Portal (WebUI) architecture
Troubleshooting needs to be conducted when you have problems accessing the Gaia Portal, for example:
User cannot access the Gaia Portal.
User cannot access specific pages of the Gaia Portal.
Log in to Gaia Portal succeeded, but then the Gaia Portal is stuck.
The browser displays errors on several pages.
Table of Contents
Browser displays an error
Error on specific page in Gaia Portal
Gaia Portal fails to execute a command or function
Gaia Portal crashes
Gaia Portal failed to load
Access to Gaia Portal failed
Gaia Portal failed to load showing blank page
Changing the Gaia Portal port in Clish results in warning
Cannot access Gaia portal, browser shows "Page cannot be displayed"
Cannot connect to Gaia portal after changing the name of Security Gateway
Gaia Portal is not accessible/responsive after upgrade
Check if you have connectivity to the machine from the client machine via ping. Capture the traffic with tcpdump to see if pings can reach the machine.
When browsing to the Gaia portal, check the HTTPS connections:
Capture the traffic with tcpdump to see that the HTTPS connections are being seen on the machine.
If HTTPS connections are seen on the machine, and this machine is Security Gateway / Cluster member, then run a simple kernel debug to check these HTTPS connections are dropped: fw ctl zdebug + drop. If there is a doubt, and this machine is NOT connected to any network (except your test computer), then try unloading the Firewall policy: fw unloadlocal (to reload the policy, run: fw fetch localhost command).
Check if the Multi-Portal is not routing the Gaia connections to the wrong portal. Run fw ctl zdebug + crypt command. If there is a doubt, and this machine is NOT connected to any network (except your test computer), then try unloading the Firewall policy to disable Multi-Portal: fw unloadlocal (to reload the policy, run: fw fetch localhost command).
If indeed Multi-Portal routes the Gaia connections to the wrong portal, then check that the Gaia Portal port is configured in SmartConsole in the corresponding object and see that the browser connects to the same port.
Check the Apache server logs to see if Gaia connections arrive at the Apache server:
Examine the files in the /usr/local/apache2/logs/
Examine the files /var/log/httpd2_* and /var/log/httpd_*
Check the ownership and permissions of the TCL files in the /web/cgi-bin2/ directory with ls -al /web/cgi-bin2/ command. These TCL files should have:
The following ownership: admin root
The following permissions: -r-xr-xr-x
Note: the httpd_dyno.tcl file located in this directory, has different permissions since it is obsolete and is not used by Gaia Portal anymore.
To correct the ownership / permissions, run:
For ownership: chown -v admin:root /web/cgi-bin2/*
For permissions: chmod -v a=rx /web/cgi-bin2/*
Check the ownership and permissions of /usr/bin/cgisu file with ls -l /usr/bin/cgisu command. This file should have:
The following ownership: admin config
The following permissions: -r-sr-x---
To correct the ownership / permissions, run:
For ownership: chown -v admin:config /usr/bin/cgisu*
For permissions: chmod -v 4550 /usr/bin/cgisu
Check that the files /web/conf/server.key and /web/conf/server.crt are not empty with the following commands:
(8) Changing the Gaia Portal port in Clish results in warning
"WARNING This command is for initial use. SSL port should be set through SmartDashboard. Changing the port may cause inconsistency with the settings on the SmartDashboard. Are you sure you want to continue?(Y/N) [N] "It is recommended to change the port using the Platform Portal section of the object in SmartDashboard. Add the port to the end of the Main URL and push policy. "show web ssl-port" should now display the port in the Main URL
Open the Security Gateway / Cluster object and go to the "Platform Portal" pane.
In the "Main URL" field, set the desired port (e.g., port 4434): https://IP_ADDRESS:PORT
Click on OK to apply the changes.
Install the security policy on this Security Gateway / Cluster object.
Note: Using Clish to change portal port on Security Gateway will be overwritten on a policy installation. After the change the httpd process can be seen listening to the new port with "netstat -lpn|grep port". Port 443 is handled by he mpdaemon and will not be listed in netstat.
For Security Management Server:
Connect to command line on Security Management Server and log in to Clish.
Set the desired port (e.g., port 4434): HostName> set web ssl-port <Port_Number>
Save the changes: HostName> save config
Verify that the configuration was saved: [Expert@HostName]# grep 'httpd:ssl_port' /config/db/initial
In SmartConsole, go to the 'Security Gateway object -> IPSec VPN -> Repository Of Certificates Available to the Gateway', and delete the certificate that contains the old name of the gateway.
If the firewall does not have the IPSEC VPN blade enabled, temporarily enable this blade under General Properties and view the Certificate(s) available to the gateway. Exercise caution to ensure that the certificate is issued by the Security Management server, as in the example below:
Ensure that the issuer name shows the Security Management server name.
After successfully confirming step 3 above, click "OK" and highlight the certificate again and click "Remove".
A warning will come up that the certificate will be removed and a new one will be generated--click "OK" or "yes".
Go back and confirm that the new certificate now shows the new hostname.
Install policy to the Security Gateway in question, and now there should be access to the WebUI.
(11) Gaia Portal is not accessible/responsive after upgrade
Gaia Portal is stuck in the loading icon after entering username and password.
"The URL you requested could not be found on the server" message is displayed in the Web browser.
"sec_error_reused_issuer_and_serial" message is displayed in the Web browser.
Debug of Gaia Portal per sk84561 - /var/log/httpd2_error_log file - repeatedly shows: Error: unable to stat file /tmp/<Name_of_Some_File>.xsl: No such file or directory, referer: https://<IP_Address>/.../cgi-bin/home.tcl
"No WebUI and RBA error - permission denied" is repeated in /var/log/messages
CPWMD process fails to start.
Corruption in the SecurePlatform WebUI configuration file.
Wrong permissions were set to the WebUI web server files/directories.
Note: Close the web browser before making any modifications. Web browsers can cache a negative connection attempt.
On SecurePlatform OS only: Make sure that the CPWM process is working properly and not exiting or restarting itself:
Check the CPWMD daemon's log file /opt/spwm/log/cpwmd.elg. The last entry in the file should be "CPWMD is running".
If you constantly see the message "CPWMD going to die on signal 6", it means that there is a corruption in the configuration files. Continue to Step 2.
On SecurePlatform OS only: Make sure that the SecurePlatform WebUI configuration file /opt/spwm/conf/cp_http_admin_server.conf is intact, does not have non-Unix characters, or other corruptions. The configuration file should look as follows:
## Configuration file for Check Point Web Server
# This file is dynamically created
# Last modified by admin at DATETIME
On SecurePlatform OS only: Permissions of the WebUI server should be as follows:
The directory that contains the server setup - /opt/spwm/www - should have these permissions:
drwx------ 11 nobody nobody 4096 Aug 31 23:41 www
The directory that contains the server's HTML setup - /opt/spwm/www/html - should have these permissions:
drwx------ 8 nobody nobody 4096 Aug 31 23:42 html
The files and sub-directories inside the /opt/spwm/www/html/ directory should have the following permissions:
Note: All files inside the /opt/spwm/www/html/ directory must have "nobody:nobody" ownership.
-rwxr-x--- 1 nobody nobody 55056532 Aug 31 23:41 SmartConsole.exe
-rwxr-x--- 1 nobody nobody 55056532 Aug 31 23:42 SmartConsole_RXX.exe
-r-x------ 1 nobody nobody 857 Aug 31 23:42 appParams.js
dr-x------ 3 nobody nobody 4096 Aug 31 23:41 help
-r-------- 1 nobody nobody 18955 Aug 31 23:42 index.html
dr-x------ 3 nobody nobody 4096 Aug 31 23:41 spwm_dev_mgmt
dr-x------ 3 nobody nobody 4096 Aug 31 23:41 spwm_fw1
dr-x------ 3 nobody nobody 4096 Aug 31 23:41 spwm_network
dr-x------ 6 nobody nobody 4096 Aug 31 23:41 spwm_splat
drwx------ 3 nobody nobody 4096 Sep 11 23:12 webis
To view the current permissions of a file, use the 'ls -l' command on the file.
For example, to see the permissions for the /opt/spwm/conf/cp_http_admin_server.conf file, run:
[Expert@HostName]# ls -l /opt/spwm/conf/cp_http_admin_server.conf
To view the current permissions of a directory, use the 'ls -l' command on its parent directory.
For example, to see the permissions for the /opt/spwm/www/html directory, run:
[Expert@HostName]# ls -l /opt/spwm/www
To change the access permissions, use the 'chmod' command: