topic Re: Unable to connect via ASDM after upgrading ASDM image in ASA to 72 in Cisco Software Discussions

Unable to connect via ASDM after upgrading ASDM image in ASA to 7202

debbiebeitler — Wed, 17 Jan 2024 19:26:09 GMT

Tried to upgrade ASDM on a 9.16 ASAv, from 7181-152 to 7202.
Worked fine on the "secondary" asa.
But on the active one, Cannot connect after restarting ASDM.
I goes through the entire log in process, and then I get "ASDM cannot be loaded, hostname wrong".

I can still SSH into it, and everything look goods, so I did a reload. And now I get "The certificate present in this device is not valid. Certificate date is Expired...."
The Date on the ASA is fine.
It has the same certificates and CA certs as did the backup. None of which show as expired.

I reverted back to the previous ASDM image for now.

Re: Unable to connect via ASDM after upgrading ASDM image in ASA to 72

pieterh — Thu, 18 Jan 2024 15:57:36 GMT

>>> Tried to upgrade ASDM on a 9.16 ASAv, from 7181-152 to 7202.
Worked fine on the "secondary" asa. <<<
this is not possible!
you need to set your ASDM version from the primary (c.q. active) ASA
it will activate this for BOTH failover members at the same time (as this is replicated)

my workflow is for the GUI (old ASDM version)
- transfer the ASDM image to the standby ASA
- answer NO to the question for setting this as the default ASDM image
- transfer the ASDM image to the active ASA
- answer YES to the question for setting this as the default ASDM image
- restart ASDM connection to use the new version

Re: Unable to connect via ASDM after upgrading ASDM image in ASA to 72

debbiebeitler — Thu, 18 Jan 2024 18:50:32 GMT

This is an ASA virtual. So the config is not shared or replicated between them. basically they are two separate devices with what amounts to a load balancer between them.

Re: Unable to connect via ASDM after upgrading ASDM image in ASA to 72

debbiebeitler — Thu, 18 Jan 2024 19:52:45 GMT

Same result with asdm-7201. Using asdm-7191-95 works fine.

Re: Unable to connect via ASDM after upgrading ASDM image in ASA to 72

debbiebeitler — Thu, 18 Jan 2024 20:06:55 GMT

Upgrading the ASA tp 9.18.3.56 does not make a difference. Still works with asdm-7191. but not with either asdm 7201 or 7272

Re: Unable to connect via ASDM after upgrading ASDM image in ASA to 72

pieterh — Fri, 19 Jan 2024 07:33:14 GMT

back to the first post
>>> And now I get "The certificate present in this device is not valid. Certificate date is Expired...." <<<
and your addition >>> basically they are two separate devices with what amounts to a load balancer between them <<<
did you check the consistency of certificates between the two ASA's (maybe also the load-balancer) ?
(IS the expected certificate assigned to the management interface ?)

Re: Unable to connect via ASDM after upgrading ASDM image in ASA to 72

debbiebeitler — Fri, 19 Jan 2024 15:20:53 GMT

On both units, there are no certificates assigned to the management interface. Only to the public and internal.

However, I accessed the management interface with a browser and saw that it using an older VPN cert "ssl trust-point <expired cert>" management. Odd thing is that in the ASDM, it did not show a cert attached to the management interface. The other one that worked fine, was using the self-signed ASA certificate. I removed the line "ssl trust-point" line for the management interface and it went back to using the self-signed cert which has not expired. So ASDM is now happy with version 7202.

Thanks for helping the light bulb go off.

Re: Unable to connect via ASDM after upgrading ASDM image in ASA to 72

pieterh — Fri, 19 Jan 2024 15:43:06 GMT

I'm happy to hear you found the interfering configuration
Regards,

Pieter

Re: Unable to connect via ASDM after upgrading ASDM image in ASA to 72

Ced W — Thu, 15 Aug 2024 18:28:19 GMT

Hello,
I am having the same problem. I only have 1 ASA5525 running ASA Version 9.14(4)24 and ASDM version 7.18(1)152. ASA upgrade went fine. but when I tried to upgrade the ASDM, I received the error "The certificate present in this device is not valid. Certificate date is Expired or not valid as per current date".

How do I roll back the ASDM version if I do not have access to the ASA through the ASDM ...? Thank you ...!

Re: Unable to connect via ASDM after upgrading ASDM image in ASA to 72

tomasz.gluszko — Sat, 26 Oct 2024 12:02:34 GMT

Just add in Java security tab https://ip_address_asa - then ASDM 7202 will work as well