topic Re: Cisco 9115AXI EWC cannot access to WebUI remotely in Wireless

Cisco 9115AXI EWC cannot access to WebUI remotely

JohnAJ — Mon, 05 Jul 2021 20:11:09 GMT

Hi all,

I have an issue with my Cisco 9115AXI EWC where I can't access via WebUI. I have enable the http and http-secure server as well but failed.

I have saw the traffic that pass through the firewall (Palo Alto), it shows that the application incomplete and status is aged-out. There is no blocking in the firewall since all the traffic is allow for this IP management segment for the EWC.

Anyone facing this issue before and give suggestion, if any?

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Mark Elsen — Tue, 20 Apr 2021 07:00:05 GMT

- Does it work from a local-perspective, the palo alto message is for instance discussed in this thread :

https://live.paloaltonetworks.com/t5/general-topics/aged-out-in-allowed-traffic-logs/td-p/295534

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

JohnAJ — Wed, 21 Apr 2021 23:35:57 GMT

Hi marce1000,

what i understand on the article, means the traffic going to the EWC WebUI is using different route, then when it comes back, it using other route?

But I dont think thats the issue since we have also switches and routers there, and if I am trying accessing their WebUI, somehow, it success.

I was thinking its the bug on the version, I have downgrade and upgrade as well to the latest version, however, still not solve the problem.

Any suggestion where I can check?

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Scott Fella — Thu, 22 Apr 2021 02:23:08 GMT

Are you able to access the WebUI from a local subnet or even from the same subnet? Validate if that is working first or not.

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

JohnAJ — Thu, 22 Apr 2021 02:24:18 GMT

Hi Scott,

Yes, I am able to access from same subnet.

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Scott Fella — Thu, 22 Apr 2021 03:23:08 GMT

Then there is nothing wrong with from what I can tell. If you can access the WebUI from another vlan that doesn’t hit your FW just you L3, then you know that the WebUI is functioning and must be your infrastructure.

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Mark Elsen — Thu, 22 Apr 2021 06:17:23 GMT

- What error do you get ? Also can you then ping the 9115 (e.g.)

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

JohnAJ — Thu, 22 Apr 2021 10:01:29 GMT

Hi Marce1000,

There is no error I get from the browser, its just that keep loading and display at below "Waiting for 10.62.31.254"

I can ping without any ping drop and able to SSH remotely on the same PC that I use to access the WebUI.

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Mark Elsen — Thu, 22 Apr 2021 14:43:00 GMT

- Make sure that no local rules such as ACL or other prevent this remote access WebUI access. In that respect, using SSH check the device logs when this is attempted. Also try wget to fetch the page , and turn on debugging , this may give more insights (too).

https://linux.die.net/man/1/wget

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Rich R — Thu, 22 Apr 2021 16:27:24 GMT

Can you ping the EWC remotely? (in other words does it have a route back to the remote user?)

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

JohnAJ — Mon, 22 Nov 2021 01:42:12 GMT

Hi rrudling,

Sorry for the late feedback. Yes I can ping the EWC and I also able to access via SSH remotely. I also suspecting the issue is either from the Palo Alto remote site or the local site. However, the Firewall team inform they have allow all the session and not blocking it. Not sure how to troubleshoot on this, currently, I am using SSH to configure the EWC remotely. I will use GUI when Im at site.

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

JohnAJ — Mon, 22 Nov 2021 01:43:13 GMT

Hi marce1000,

sorry for the late reply. I might can use this way also to see if the traffic is really reaching the EWC. Will try it later. thanks!

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Marcel B — Wed, 07 Jun 2023 09:23:02 GMT

Hello JohnAJ,

i know this thread is two years old, but did you get solved the problem finally?

I have a similiar situation with three Sophos firewalls instead of PaloAlto and a IPSec Tunnel between Headquarter and Branch Offices. Local access in same subnet or from other subnet behind the same firewall, no problem. But if I try to access the EWCs behind the firewalls at the branch offices over the IPSec Tunnel, no way. Curios thing, if i connect to firewall at HQ by VPN from external, i can access the EWCs behind the walls in the branch offices. I am currently at this with Sophos Support, they are analyzing packet captures from all three walls.

best regards

Marcel

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Rich R — Wed, 07 Jun 2023 16:08:52 GMT

Have you got a packet capture of the PC you're trying to access the GUI from?
Do you get *any* reply from the EWC?
Just an idea (in case it's fragmentation related - since you mention IPSEC): try "ip tcp mss 1250" on the EWC?
And if your firewall supports TCP MSS adjust then set that to 1250 too (your remote VPN might be doing that which is why it works)

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Marcel B — Mon, 12 Jun 2023 08:34:41 GMT

Hello Rich R,

thanks for your answer. Yes, i get a reply, if I analyzed it right, it stops somewhere after the SSL handshake, i can see the certificate in the packets and many, many retransmissions, after a while the connection is resetted. SSH connection ist no problem, i am also recieving snmp and syslog data, so it seems to be only http/https related problem.

I configured "ip tcp mss 1250" on one of the controllers to test (by ssh), but no luck. Do i have to reboot the EWC to activate this setting? If yes, i will have to wait for the night, as EWC is in production.

The Sophos UTM doesnt seem to support this option, at least not on the IPSec Tunnel, only on real ethernet interfaces. I have remote session with them tomorrow, maybe the will find something.

best regards
M. Baltruschat

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Rich R — Mon, 12 Jun 2023 09:54:47 GMT

> i can see the certificate in the packets and many, many retransmissions, after a while the connection is resetted.

That definitely sounds like a problem with MTU and fragmentation so I guess you'll have to work it out with the firewall vendor. If you can set TCP MSS closer to the remote source that's also an option (as long as the firewall doesn't override it with something else). For example is there a router at the other end where you could set it?

Changes to TCP MSS do not require reload. Any new TCP connections after the config has changed will pick up the change.

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Marcel B — Thu, 15 Jun 2023 08:57:52 GMT

Hello Rich R,
many thanks for this informations, I will work this out further with Sophos Support.

best regards/beste Grüße
M. Baltruschat

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

khempkins — Sat, 11 Nov 2023 01:58:24 GMT

So, years old topic but.... I have the exact same problem. Did anyone ever find out what the problem is?

I have a Palo fw and it's not possible to access the management gui through the firewall. I have tried to create a test-network with an svi and access the gui from another network using the switch as a router - works fine.

But as soon as I route through the Palo firewall it just times out. Accessing a switch gui on the same network (as the EWC/AP) works.

So there is something with the ewc webserver that doesn't like traversing firewalls...

Any luck with solving this one?

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

Rich R — Sat, 11 Nov 2023 13:26:17 GMT

Have you used debugs and packet captures on the firewall to confirm:
- The replies from the EWC reach the firewall?
- why the firewall is dropping them? Is it filtering the TLS version or ciphers or hashes being used?

Presuming you've covered all the basics mentioned previously?
Confirm you can ping the EWC which proves the routing is correct for a start?
If there's no VPN in the path then MTU/fragmentation should not be a problem but if there is (or any other MTU/MSS restriction) then try setting "ip tcp mss 1300" on the EWC.
And of course make sure you're using up to date software - for EWC refer to TAC recommended for 9800 (link below) and make sure the firewall is up to date too.

Re: Cisco 9115AXI EWC cannot access to WebUI remotely

LiWenbin2008 — Sun, 05 May 2024 11:02:38 GMT

Hi khempkins, I have same problems. Have you fixed it ? thanks