What to check when Login to Unit (LTU) is not working from GMS?

07/29/2021 1 People found this article helpful 185,877 Views

Download

Print

Share

• LinkedIn
• Twitter
• Facebook
• Email
• Copy URL The link has been copied to clipboard

Description

In this article, we explained the things to check when the LTU (Login to Unit) is not working from GMS.

Resolution

Please refer to the network diagram for a typical GMS setup.

Required GMS Version: GMS 9.3 (Build: 9316.1261) with Service Pack 1

GMS Gateway Firewall Requirements:

For the Login to Unit (LTU) to work from the Internet make sure the following two changes are made in the GMS gateway firewall from the Internet.

1. Make sure TCP port 8585 is forwarded to GMS All-in-One PC (AIOP) from GMS gateway firewall.
2. Also, check the outbound HTTPS management port of the respective firewall is allowed from the GMS AIOP server in the GMS gateway firewall.

Requirements in the Remote Firewall to which we login:

1.  Make sure to allow the Firewall's HTTPS management traffic from the public IP of GMS AIOP server (if the device is acquired on WAN IP) or private IP of GMS AIOP server (if the firewall is acquired on site to site VPN).

Other Suggestions:

• Please check whether the GMS is using a custom cert or default cert. It's a good idea to check LTU using the GMS default cert.
• If GMS Certificate or GMS management port has been changed try to reboot GMS before checking LTU. 

How to check firewall access directly from GMS:

>> Windows: Just open the Web browser from the GMS server and try to login to the remote firewall with its management port then check if we can get the firewall login page. 

>> Virtual Appliance (ESXi):

Login into GMS via SSH and try with wget command to see we get a 200 OK response code.

EXAMPLE: GMS server IP which we used in the below command is 10.67.59.41. Please change your correct GMS server IP instead of 10.67.59.41.

Command: wget https://10.67.59.41:8443  --no-check-certificate

NOTE: If your firewall is using a custom certificate then please remove --no-check-certificate from the above command.

Related Articles

• Specific syslog IDs are not seen in Analytics reports
• Upgrading to Analytics 2.5.0.4
• How to upgrade firmware for a group of firewalls in NSM

Categories

• Management and Reporting > GMS > System