topic I am confused. Can you in Network Security

ASDM Failure

bowman — Tue, 12 Mar 2019 05:11:04 GMT

I inherited an ASA with a new customer. I can connect using CLI, but would prefer ASDM. I have tried to make the changes to the config and to me it looks like it should work, but I am missing something. When I connect to https://XXX.XXX.183.202 , I get the normal "Continue to this website (Not recommended) like I do will all the rest of my ASA's. But when I click on it, I get the old HTTP error 404. Can someone look at my config and let me know what I have missed?

Thanks in advance.

what Operating system are you

davedoggydogg — Thu, 04 Dec 2014 15:52:36 GMT

what Operating system are you using on your computer?? uninstall all java versions, reboot and try using and downloading JAVA 8 update 25

make sure youre asa device is allowing asdm (https/ssh/telnet) traffic on that port. if u are unsure then try it from the management port.

I do not believe it is the

bowman — Thu, 04 Dec 2014 15:55:04 GMT

I do not believe it is the computer. I have tried 3 different computer's and use my main computer to manage about 10 other asa's without issue. The same thing happens on all machines.

newer asa likes the newer

davedoggydogg — Thu, 04 Dec 2014 16:01:40 GMT

newer asa likes the newer java, the older ones like the older java, just make sure u are running newer java if its a newer asdm software.

also make sure the ports are accessible thru firewall rules

I have other ASA's at the

bowman — Thu, 04 Dec 2014 16:04:56 GMT

I have other ASA's at the same revision. I can connect to them, but I set them up from scratch. I inherited this one and it was originally setup not to use HTTP. I do not see anything in the conf (see attached file) that would block the connection. This is why I am at a loss.

not sure what port u are

davedoggydogg — Thu, 04 Dec 2014 17:02:43 GMT

not sure what port u are trying to connect from but try this depending on the port u

are connected to

http 192.168.100.0 255.255.255.0 inside

http 192.168.10.0 255.255.255.0 inside

if u inhereted it, best thing to do is reset it and manage it from management and start over...here is CLI command to reset...after it resets plug it into management port and config as desired thru asdm

en
<enter>
<password>
config t
config factory-default
reload save-config noconfirm

Yes, I know a reset to

bowman — Thu, 04 Dec 2014 19:53:46 GMT

Yes, I know a reset to factory would allow it to do what I need, but I am trying to avoid that because it has a site-to-site vpn tunnel connected and do not want to take that down. I will use that as a last resort.

I was hoping someone would look at the attached config and say "OH! There's your problem. Change this to that and it should work."

It could be that the ASDM

Marius Gunnerud — Thu, 04 Dec 2014 20:58:24 GMT

It could be that the ASDM image is corrupt. I suggest removing it and then get your hands on a known working version (from one of your other ASAs for example) and copy that into the ASA and try from there.

Please remember to select a correct answer and rate helpful posts

try the command above, just

davedoggydogg — Thu, 04 Dec 2014 21:19:21 GMT

try the command above, just change it to match your network subnet

I am confused. Can you

bowman — Thu, 04 Dec 2014 21:26:27 GMT

I am confused. Can you explain to me what the command above does? I thought factory-default put everything back to factory unless I specified a different internal network but it still wiped out all the other parts of the original config. Does the statement "reload save-config noconfirm" do something additional?

http 192.168.100.0 255.255

davedoggydogg — Thu, 04 Dec 2014 22:12:32 GMT

http server enable

http 192.168.100.0 255.255.255.0 inside

the command above enables asdm traffic on the inside port from the specified network subnet...just replace the numbers with your network subnet.

reference:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/mgaccess.html

I think if you look at the

bowman — Fri, 05 Dec 2014 00:06:43 GMT

I think if you look at the config file I sent, you will see that command is already in the running config. This is a screen shot of the config attached.

As I have stated, this is not my first ASA. I have a bunch of these and all the others work as required. I inherited this one and cannot determine what the previous admins did to block ASDM. Hoping someone else can see what I have missed.

I don't know if it makes a

bowman — Fri, 05 Dec 2014 00:14:36 GMT

I don't know if it makes a difference or not, but comparing this config with others I have, I notices one difference I have not seen before. This config shows 2 boot image files being loaded. Could that have something to do with the issue? See below.

this might sound silly...but

davedoggydogg — Fri, 05 Dec 2014 00:21:29 GMT

this might sound silly...but are you trying to connect thru the management port? if u are..... then maybe as Marius Gunnerud said, image may be corrupt.

I checked a couple of other

bowman — Fri, 05 Dec 2014 14:25:53 GMT

I checked a couple of other configs I have for other devices and do not see the entries for "boot system disk" or for "asdm image" in the ones that I have setup and are working correctly.

Two questions.

What are the entries for?

If removed, would the device reboot and come back to the same state it is currently in?

show running-config boot

davedoggydogg — Fri, 05 Dec 2014 15:39:20 GMT

show running-config boot system

hostname(config)# show running-config boot system

boot system disk0:/cdisk.bin

boot system disk0:/asa841-smp-k9.bin

Shows the current boot images configured (up to 4). The ASA uses the images in the order listed; if the first image is unavailable, the next image is used, and so on. You cannot insert a new image URL at the top of the list; to specify the new image to be first, you must remove any existing entries, and enter the image URLs in the order desired, according to the following steps.

--------------------------------------------------------

no boot system {disk0:/ | disk1:/ }[path /] asa_image_name

hostname(config)# no boot system disk0:/cdisk.bin

hostname(config)# no boot system disk0:/asa841-smp-k9.bin

Removes any existing boot image configurations so you can enter the new boot image as your first choice.

-----------------------------------------------------------------------

before u go flashing anything, i would recomend that you just do a regular factory reset and see if it fixes the issue.

The boot system commands is

Marius Gunnerud — Fri, 05 Dec 2014 21:40:46 GMT

The boot system commands is not he issue. Basically when you have the two images statically configured it will try to boot the ASA in the order they are configured. So if the 8.2 image fails to boot it will try the 7.2 image. If you do not have any boot system commands configured then the ASA will try booting the ASA from images it finds in flash top to bottom.

forgive me if you have already answered the following question, but do you get the same result when accessing the ASDM via the inside interface from the local LAN?

What subnet is the following associated with:

http xxx.xxx.0.0 255.255.0.0 outside

Reason I as is because your SSH configuration is configured for 0.0.0.0 0.0.0.0.

Please remember to select a correct answer and rate helpful posts

he has this route with it

davedoggydogg — Fri, 05 Dec 2014 22:04:08 GMT

he has this route with it

route outside 0.0.0.0 0.0.0.0 XXX.XXX.183.201 1

so ssh would look for XXX.XXX.183.201 coming from outside leading to "error 404 page not found"??

thats why i said try it from management port earlier posts

I have tried it from an

bowman — Sat, 06 Dec 2014 04:20:39 GMT

I have tried it from an inside machine at a 192.168.100.xxx ip address and I have tried it from an outside address of XXX.XXX.0.0 which is my office IP address that I maintain about 15 other ASA's of various flavors.

Hi,It's a very long

Vibhor Amrodia — Sat, 06 Dec 2014 05:53:51 GMT

Hi,

It's a very long discussion so i would request you to update the details on this issue once again please:-

ASDM image Version:-

ASA device version:-

JAVA update

Outputs of :-

show run asdm

show run aaa

show run http

ahso asp table soc

show run all ssl

show vers

Thanks and Regards,

Vibhor Amrodia