• Check if you have connectivity to the machine from the client machine via ping.
  Capture the traffic with tcpdump to see if pings can reach the machine.
  
  
• When browsing to the Gaia portal, check the HTTPS connections:
  
  
  • Capture the traffic with tcpdump to see that the HTTPS connections are being seen on the machine.
    
    
  • If HTTPS connections are seen on the machine, and this machine is Security Gateway / Cluster member,
    then run a simple kernel debug to check these HTTPS connections are dropped: fw ctl zdebug + drop.
    If there is a doubt, and this machine is NOT connected to any network (except your test computer),
    then try unloading the Firewall policy: fw unloadlocal (to reload the policy, run: fw fetch localhost command).
    
    
  • Check if the Multi-Portal is not routing the Gaia connections to the wrong portal.
    Run fw ctl zdebug + crypt command.
    If there is a doubt, and this machine is NOT connected to any network (except your test computer),
    then try unloading the Firewall policy to disable Multi-Portal: fw unloadlocal (to reload the policy, run: fw fetch localhost command).
    
    
  • If indeed Multi-Portal routes the Gaia connections to the wrong portal, then check that the Gaia Portal port is configured
    in SmartConsole in the corresponding object and see that the browser connects to the same port.
    
    
  • Check the Apache server logs to see if Gaia connections arrive at the Apache server:
    
    
    • Examine the files in the /usr/local/apache2/logs/  
    • Examine the files /var/log/httpd2_* and /var/log/httpd_*
  
  
  
• Check the ownership and permissions of the TCL files in the /web/cgi-bin2/ directory with ls -al /web/cgi-bin2/ command.
  These TCL files should have:
  
  • The following ownership: admin root
  • The following permissions: -r-xr-xr-x
  
  Note: the httpd_dyno.tcl file located in this directory, has different permissions since it is obsolete and is not used by Gaia Portal anymore.
  
  To correct the ownership / permissions, run:
  
  • For ownership: chown -v admin:root /web/cgi-bin2/*
  • For permissions: chmod -v a=rx /web/cgi-bin2/*
  
  
  
• Check the ownership and permissions of /usr/bin/cgisu file with ls -l /usr/bin/cgisu command.
  This file should have:
  
  • The following ownership: admin config
  • The following permissions: -r-sr-x---
  
  To correct the ownership / permissions, run:
  
  • For ownership: chown -v admin:config /usr/bin/cgisu*
  • For permissions: chmod -v 4550 /usr/bin/cgisu
  
  
  
• Check that the files /web/conf/server.key and /web/conf/server.crt are not empty with the following commands:
  
  • cat /web/conf/server.key
  • cat /web/conf/server.crt
  
  Related solutions:
  
  • sk97648: How to create and set certificate for Gaia Portal
  • sk108252: How to change Gaia Portal's certificate from SHA-1 to SHA-256
  • sk109593: How to configure Gaia Portal to use a 3rd party CA-issued Wildcard certificate

For Security Gateway:

In SmartConsole, perform:

1. Open the Security Gateway / Cluster object and go to the "Platform Portal" pane.
2. In the "Main URL" field, set the desired port (e.g., port 4434):
   https://IP_ADDRESS:PORT
3. Click on OK to apply the changes.
4. Install the security policy on this Security Gateway / Cluster object.

Note: Using Clish to change portal port on Security Gateway will be overwritten on a policy installation. After the change the httpd process can be seen listening to the new port with "netstat -lpn|grep port". Port 443 is handled by he mpdaemon and will not be listed in netstat.

For Security Management Server:

1. Connect to command line on Security Management Server and log in to Clish.
2. Set the desired port (e.g., port 4434):
   HostName> set web ssl-port <Port_Number>
3. Save the changes: HostName> save config
4. Verify that the configuration was saved:
   [Expert@HostName]# grep 'httpd:ssl_port' /config/db/initial

To resolve the problem, remove the ssl_mutex file:

1. Run # rm -r /usr/local/apache2/logs/ssl_mutex

2. Restart the web server daemon:
   

   # tellpm process:httpd2
   # tellpm process:httpd2 t

1. In SmartConsole, go to the 'Security Gateway object -> IPSec VPN -> Repository Of Certificates Available to the Gateway', and delete the certificate that contains the old name of the gateway.
2. If the firewall does not have the IPSEC VPN blade enabled, temporarily enable this blade under General Properties and view the Certificate(s) available to the gateway.
   Exercise caution to ensure that the certificate is issued by the Security Management server, as in the example below:
   
   Subject: CN=GwyC-77.10 VPN Certificate,O=Mgmt..imce48
   Issuer: O=Mgmt..imce48

    

3. Ensure that the issuer name shows the Security Management server name.
4. After successfully confirming step 3 above, click "OK" and highlight the certificate again and click "Remove".
5. A warning will come up that the certificate will be removed and a new one will be generated--click "OK" or "yes".
6. Go back and confirm that the new certificate now shows the new hostname.
7. Install policy to the Security Gateway in question, and now there should be access to the WebUI.

Note: Close the web browser before making any modifications. Web browsers can cache a negative connection attempt.

1. On SecurePlatform OS only:
   Make sure that the CPWM process is working properly and not exiting or restarting itself:
   
   
   • Check the CPWMD daemon's log file /opt/spwm/log/cpwmd.elg.
     The last entry in the file should be "CPWMD is running".
     
     
   • If you constantly see the message "CPWMD going to die on signal 6", it means that there is a corruption in the configuration files. Continue to Step 2.
   
   
   
2. On SecurePlatform OS only:
   Make sure that the SecurePlatform WebUI configuration file /opt/spwm/conf/cp_http_admin_server.conf is intact, does not have non-Unix characters, or other corruptions. The configuration file should look as follows:

   ## Configuration file for Check Point Web Server
   #
   # This file is dynamically created
   #
   # Last modified by admin at DATE TIME
   #
   SESSION_TIMEOUT=900
   SSL=1
   WEBROOT=/opt/spwm/www
   SERVCERT=/opt/spwm/servcert/servcert.p12
   CERTPWD=
   LOGDIR=/opt/spwm/log
   TEMPDIR=/opt/spwm/tmp
   SESSION_TIMEOUT=900
   ACTIVE=1
   ADDRESS=0.0.0.0
   PORT=4434
   

   
   
3. On SecurePlatform OS only:
   Permissions of the WebUI server should be as follows:
   
   
   1. The directory that contains the server setup - /opt/spwm/www - should have these permissions:
      
      drwx------ 11 nobody nobody 4096 Aug 31 23:41 www
      
      
   2. The directory that contains the server's HTML setup - /opt/spwm/www/html - should have these permissions:
      
      drwx------ 8 nobody nobody 4096 Aug 31 23:42 html
      
      
   3. The files and sub-directories inside the /opt/spwm/www/html/ directory should have the following permissions:
      
      Note: All files inside the /opt/spwm/www/html/ directory must have "nobody:nobody" ownership.
      
      

      -rwxr-x---  1 nobody nobody 55056532 Aug 31 23:41 SmartConsole.exe
      -rwxr-x---  1 nobody nobody 55056532 Aug 31 23:42 SmartConsole_RXX.exe
      -r-x------  1 nobody nobody      857 Aug 31 23:42 appParams.js
      dr-x------  3 nobody nobody     4096 Aug 31 23:41 help
      -r--------  1 nobody nobody    18955 Aug 31 23:42 index.html
      dr-x------  3 nobody nobody     4096 Aug 31 23:41 spwm_dev_mgmt
      dr-x------  3 nobody nobody     4096 Aug 31 23:41 spwm_fw1
      dr-x------  3 nobody nobody     4096 Aug 31 23:41 spwm_network
      dr-x------  6 nobody nobody     4096 Aug 31 23:41 spwm_splat
      drwx------  3 nobody nobody     4096 Sep 11 23:12 webis
      

   Notes:

   • To view the current permissions of a file, use the 'ls -l' command on the file.
     
     For example, to see the permissions for the /opt/spwm/conf/cp_http_admin_server.conf file, run:
     
     [Expert@HostName]# ls -l /opt/spwm/conf/cp_http_admin_server.conf
     
     
   • To view the current permissions of a directory, use the 'ls -l' command on its parent directory.
     
     For example, to see the permissions for the /opt/spwm/www/html directory, run:
     
     [Expert@HostName]# ls -l /opt/spwm/www
     
     
   • To change the access permissions, use the 'chmod' command:
     
     [Expert@HostName]# chmod [-R] u=[rwx],g=[rwx],o=[rwx] TARGET_FILE_or_DIRECTORY
     
     where
     • '-R' flag should be used for recursive change (for all files inside a directory).
     • 'u=[rwx],g=[rwx],o=[rwx]' should be used for setting the specific permission for User, Group, Others.
     
     
     Run 'chmod --help' for more information.
     
     
   • To change the ownership permissions, use the 'chown' command:
     
     [Expert@HostName]# chown [-R] USER:GROUP TARGET_FILE_or_DIRECTORY
     
     where
     • '-R' flag should be used for recursive change (for all files inside a directory).
     
     
     Run 'chown --help' for more information.
   
   
   
4. On SecurePlatform OS and Gaia OS:
   Permissions of the /tmp directory should be as follows:
   
   

   drwxrwxrwt 5 admin root 4096 Jan  2 11:21 /tmp
   

   Notes:

   • To view the current permissions of a directory, use the 'ls -ld' command on the directory:
     
     [Expert@HostName]# ls -ld /tmp
     
     
   • To change the access permissions, use the 'chmod' command:
     
     [Expert@HostName]# chmod [-R] u=[rwx],g=[rwx],o=[rwx] TARGET_DIRECTORY
     
     where
     • '-R' flag should be used for recursive change (for all files inside a directory).
     • 'u=[rwx],g=[rwx],o=[rwx]' should be used for setting the specific permission for User, Group, Others.
     
     
     To set the default permissions for the /tmp directory, run:
     
     [Expert@HostName]# chmod a=rwxt /tmp
     
     Run 'chmod --help' for more information.
     
     
   • To change the ownership permissions, use the 'chown' command:
     
     [Expert@HostName]# chown [-R] USER:GROUP TARGET_DIRECTORY
     
     where
     • '-R' flag should be used for recursive change (for all files inside a directory).
     
     
     Run 'chown --help' for more information.