topic Re: ASA5508 - ASDM User Accounts in Network Security

ASA5508 - ASDM User Accounts

wynneitmgr — Mon, 06 Apr 2020 13:10:26 GMT

New to Firewall Management and need some help. We have a couple User Accounts setup in Cisco ASDM. We htought these users were for the ability to login directly to the Firewall from "outside" our network. Is that what these users are for? Do I login to our WAN IP? How do these users login. Thanks for any advise!

Re: ASA5508 - ASDM User Accounts

Rob Ingram — Mon, 06 Apr 2020 13:44:11 GMT

Hi,
Yes, these use accounts do have admin rights to login to ASDM. To configure access to login from the outside you would need to ensure you permit access "http 0.0.0.0 0.0.0.0 outside". The users need to open a web browser, enter the outside ip address and then download ASDM.

The user accounts could be also be used for remote access (however they do have full admin rights, so they could manage the ASA also).

HTH

Re: ASA5508 - ASDM User Accounts

wynneitmgr — Mon, 06 Apr 2020 14:00:19 GMT

Do I need an IP setup for HTTP? I have 3 in here for SSH.

Also, how do I know which IP address to use when I logon using web browser? Thank you for your help!

Re: ASA5508 - ASDM User Accounts

Rob Ingram — Mon, 06 Apr 2020 14:04:24 GMT

You would have to permit all IP addresses on the outside interface for ASDM/HTTPS - unless you know the source, in which case define those static IP addresses.

The IP address to connect to when using the web browser is the IP address of your "outside" interface.

HTH

Re: ASA5508 - ASDM User Accounts

wynneitmgr — Mon, 06 Apr 2020 14:26:22 GMT

Here is what I have under Access and NAT Rules.

Re: ASA5508 - ASDM User Accounts

Rob Ingram — Mon, 06 Apr 2020 14:32:11 GMT

It's got nothing to do with NAT, you need to connect to the IP address assigned to the outside interface.

Re: ASA5508 - ASDM User Accounts

wynneitmgr — Mon, 06 Apr 2020 14:43:15 GMT

I am believing it would be the same as the outside-network in my Network Objects.

Re: ASA5508 - ASDM User Accounts

Rob Ingram — Mon, 06 Apr 2020 14:53:11 GMT

Well your outside interface IP address would be part of that object "outside-network". From ASDM go to Configuration > Device Setup > Interfaces. The public IP address named "outside" would be the IP address you need to use.

Re: ASA5508 - ASDM User Accounts

wynneitmgr — Mon, 06 Apr 2020 15:21:49 GMT

Okay, I found that IP address, so now do I need to setup an Access Rule for that IP address? Thank you!!

Re: ASA5508 - ASDM User Accounts

Rob Ingram — Mon, 06 Apr 2020 15:26:44 GMT

You configure management access in ASDM as per the screenshot in your 1st reply or per my first reply, with the command "http 0.0.0.0 0.0.0.0 outside". This would permit access from any IP address on the internet to access your ASA on it's outside interface's IP address.

Re: ASA5508 - ASDM User Accounts

Marvin Rhoads — Mon, 06 Apr 2020 15:34:32 GMT

ACLs are (generally speaking) for traffic going THROUGH the firewall - not traffic TO the firewall.

It's as @Rob Ingram said for allowing management traffic (which terminates on the firewall - i.e., TO the firewall).

Re: ASA5508 - ASDM User Accounts

wynneitmgr — Mon, 06 Apr 2020 15:38:57 GMT

Does it make a difference if I already have a ASDM/HTTPS setup for Management at 0.0.0.0? Not sure if I can have both. Thanks!

Re: ASA5508 - ASDM User Accounts

Rob Ingram — Mon, 06 Apr 2020 15:44:48 GMT

You need it enabled on the outside interface if you are connecting from the outside interface, which it sounds like what you intend to do.

Re: ASA5508 - ASDM User Accounts

wynneitmgr — Mon, 06 Apr 2020 15:52:42 GMT

I get an error when trying to add

Re: ASA5508 - ASDM User Accounts

Rob Ingram — Mon, 06 Apr 2020 15:58:41 GMT

Ok, fine...you already enabled in on the outside and management interfaces in the previous screenshot. You should just apply and save the configuration, then test connection to the outside interface IP address - from an IP address that is on the outside of the ASA (in other words don't connect from your inside network).

Re: ASA5508 - ASDM User Accounts

wynneitmgr — Mon, 06 Apr 2020 16:02:35 GMT

I had not hit apply yet when I took that screenshot. So will it work if I just have the Outside set for ASDM/HTTPS and not Management?

Re: ASA5508 - ASDM User Accounts

Rob Ingram — Mon, 06 Apr 2020 16:11:00 GMT

Yes it should work on the outside interface.
You can also enable it on the management interface, if it was already enabled and you have a management network. I assume you are currently connected to the inside interface?

Re: ASA5508 - ASDM User Accounts

wynneitmgr — Mon, 06 Apr 2020 17:40:55 GMT

When I try to go to the IP on a browser Outside of Network, I get the "Connection is not Private" warning, then when I proceed it says page cannot be found. What am I missing here? Thank you.

Re: ASA5508 - ASDM User Accounts

Rob Ingram — Mon, 06 Apr 2020 17:55:25 GMT

Well it proves that you can at least access the login page, which is good!

Try appending /admin after the IP address. E.g:- "https://1.1.1.1/admin" - obviously replacing 1.1.1.1 with your IP address

If you already have ASDM installed then you don't need to open a web browser, you can just open ASDM set the IP address as the outside interface IP address and then login.

Re: ASA5508 - ASDM User Accounts

wynneitmgr — Mon, 06 Apr 2020 18:26:53 GMT

It says I have to have some service contract to download ASDM. Is that the only way to get ASDM? Thank you.