Cant access webui after update

[Jayfaas]

Hey all.  I just updated one of our 3850-48P switches from 16.6.5 to 16.12.14 over the weekend and another 3850-24P as well.  Weird thing is, I come in today and now our Sophos is blocking the web management UI for the 48P switch, but not the 24P switch.  It says "We've blocked access to this URL due to your policy.  The encryption used by the server hosting this URL is insecure."  Any ideas why one would work and not the other?  I kept the same config file and even re-ran the crypto PKI commands from the original config just to make sure it wasnt a key thing.  Maybe a certificate issue?  I dont think its the firewall either because the IP stayed the same, and all other WebUIs for our other switches work, including the one for the 24P which was running the same before/after versions.  I also made sure ip http server and ip http secure-server were both in there and they are.

[Flavio Miranda]

@Jayfaas 

  First we need to understand on thing. If you try to access the switch with a laptop connected to the switch does it send you the web interface? If it does and the problem is only remote connection, then, I think the attention need to be on what you call Sophos. I mean, what ever the problem is, I believe the answer is on the security system not necessarily on the switch. 

[Jayfaas]

Hey sorry I should have added.  I can SSH into the switch just fine, but when I try to access via web browser, I get the error.  Again the IP did not change, so we think it has something to do with the certificate or the way it presents the certificate or key that is causing the Sophos to flag it.

[Flavio Miranda]

If you access the switch switch on port 80, does it works? 

I am assuming you installed certificate on the switch at some point, right? Usually the switch does not come with certificate. 

If that is the case, have you tried to reinstall?

[Jayfaas]

I havent done one of those before.  I have only used the crypto key generate rsa general-keys modulus 1024 command in the classroom setting.  I see the crypto pki settings in the running-config.  Do I have to re-use any of that information?  After a google search, it told me to generate a new rsa key.  I went through a spare we have and when going through the crypto command, the google search said to give it a label.  Did the show command to get the label but it said that label is reserved, so I tried the command without giving it a label which I read from google will just give it the FQDN of the switch.  Before even going through that, do I need to have something specific in there, or can it be anything?  The instructions from Google tell me this:

• Generate RSA Keys: Create a new key pair for the certificate.
  crypto key generate rsa label <label> modulus 2048
• Create a Trustpoint: Define where the certificate will be stored.

  crypto pki trustpoint <trustpoint_name>
  enrollment terminal
  rsakeypair <keypair_label>
  exit
  ``` [14]

• Generate CSR: Enroll to generate the certificate request to send to your CA.
  crypto pki enroll <trustpoint_name>
• Authenticate Trustpoint: Before importing the ID certificate, authenticate the CA (paste the CA root/intermediate certificate).
  crypto pki authenticate <trustpoint_name>
• Import Signed Certificate: Import the certificate issued by your CA.
  crypto pki import <trustpoint_name> certificate

Do I have to match the trustpoint name of whats already in there?

[Flavio Miranda]

@Jayfaas 

 Before anything, if you try to access the switch using port 80 (HTTP), are you able to? 

[Jayfaas]

Hey Flavio.  I tried just typing the IP into the browser, along with http://<ip> and even http://<ip>:80 for good measure and they all redirect to https and get blocked.  These were done after clearing browser caches on Edge and Chrome.

[Flavio Miranda]

Oddly, browsers now a days is using HTTPS but you can change this

Go to chrome://settings/content/insecureContent , add your website pattern under Allowed to show insecure content

[Jayfaas]

It almost looked like it worked, but then it redirected to https again and had a red line drawn through https while still failing to load and it gave a "ERR_SSL_PROTOCOL_ERROR".

[Flavio Miranda]

The browser is still trying to use HTTPS. 

 But, it should not be a problem anyway. The switch does not come with certificate and I actually never saw anyone installing certificate on the switch. The certificate you tried to enable is self signed and will be refused by the problem anyway 

 What people do is get the insecure warning on their browser and go ahead and accept the risk. For an internal device this is pretty much ok and dont pose any problem. 

 Now, why your communication is not happening must be investigated on the security system you have 

[Jayfaas]

There is a current certificate on the switch.  I can see it in the “crypto pki” settings.  And as far as the insecure warning, we do get that with all of our webUIs on our switches so I am familiar with that.   Just wondering now why it would be Sophos if nothing has changed about that switch other than an IOS upgrade, and the other switch with the same IOS upgrade was not affected.

[Flavio Miranda]

I probably can tell you as long as you are able to perform a packet capture in the right place. Put a wireshark on the exit interface of the switch. I am not familiar with Sopho but if it runs Linux, it would be a good place to run tcpdump as well.

 If you share a .pcap file while testing the access the switch, I can take a look on the file. 

[Jayfaas]

Now I think I have another issue.  I went to try and redo the keys yesterday and started with the "zeroize" command but when I went back to create the new and use the same label as the one from the running-config, it didnt work because it said the label was already reserved.  I tried removing the label portion of the command and it asked for a domain name, which I didnt want to add because its not in any of the other switches.  Now not only can I not access via http/https, I also cant SSH, only telnet.  How can I restore/rebuild the key so we can atleast get back to SSH?  Also below is the output I got from wireshark.  I hope it can provide some information, but I am a bit weary sharing PCAP files on a public forum.

[pieterh]

>>> and it asked for a domain name, which I didnt want to add <<<
domain name and hostname this must be configure before generating the key-pair

also check if the old TLS versions (1.0,  1.1) are disabled, Sophos may be configured to accept only TLS1.2 s valid?

[Jayfaas · Accepted solution]

Ok so I have an update that may help.  We found that if we disable ip http secure-server, it allows us to use it, but this is not consistent with the rest of the switches we have here.  All the other switches have ip http secure-server enabled.  We went back through and zeroize'd the rsa key, created a new one and configured the PKI trustpoint for it, enrolled the trustpoint and binded the new cert to the HTTPS server and then re-enabled the ip http secure-server and that allowed it to work.  Thank you all very much for your help in trying to get this resolved.  Here are the brief steps below:

configure terminal

no ip http secure-server

crypto key zeroize rsa

crypto key generate rsa label <any key name here> modulus 2048

crypto pki trustpoint <Trustpoint_Name>

enrollment selfsigned

rsakeypair <key label name from above>

exit

crypto pki enroll <trustpoint name>

ip http secure-trustpoint <trustpoint name>

ip http secure-server

end

write memory