What to check when Login to Unit (LTU) is not working from GMS?

In this article, we explained the things to check when the LTU (Login to Unit) is not working from GMS.

Please refer to the network diagram for a typical GMS setup.

Required GMS Version: GMS 9.3 (Build: 9316.1261) with Service Pack 1

GMS Gateway Firewall Requirements:

For the Login to Unit (LTU) to work from the Internet make sure the following two changes are made in the GMS gateway firewall from the Internet.

1. Make sure TCP port 8585 is forwarded to GMS All-in-One PC (AIOP) from GMS gateway firewall.
2. Also, check the outbound HTTPS management port of the respective firewall is allowed from the GMS AIOP server in the GMS gateway firewall.

Requirements in the Remote Firewall to which we login:

1.  Make sure to allow the Firewall's HTTPS management traffic from the public IP of GMS AIOP server (if the device is acquired on WAN IP) or private IP of GMS AIOP server (if the firewall is acquired on site to site VPN).

Other Suggestions:

• Please check whether the GMS is using a custom cert or default cert. It's a good idea to check LTU using the GMS default cert.
• If GMS Certificate or GMS management port has been changed try to reboot GMS before checking LTU. 

How to check firewall access directly from GMS:

>> Windows: Just open the Web browser from the GMS server and try to login to the remote firewall with its management port then check if we can get the firewall login page. 

>> Virtual Appliance (ESXi):

Login into GMS via SSH and try with wget command to see we get a 200 OK response code.

EXAMPLE: remote firewall IP which we used in the below command is 10.67.59.41. Please change your correct remote firewall IP instead of 10.67.59.41.

Command: wget https://10.67.59.41:8443  --no-check-certificate

NOTE: If your firewall is using a custom certificate then please remove --no-check-certificate from the above command.