topic Unable to launch Device Manager - ASDM issue in Network Security

Unable to launch Device Manager - ASDM issue

anthonyludlow — Tue, 12 Mar 2019 03:37:04 GMT

Hi There,

I have recently upgraded our spare ASA 5510 router to version 9.1(3) with ASDM image Version 7.1(5)100.

The client i'm attempting to run the ASDM launcher on is Windows 7 x64 running the latest version of Java (7 update 5).

I am able to get to the main screen when I https to the device. I can install the ASDM launcher, but once I enter the hostname and Password I receive the following error "Unable to launch Device Manager 192.168.X.XXX".

I have gone through a check list and I can confirm the following:

- the 3des-sha1 licence is enabled

- Http server is enabled for my clients subnet

- ssl encryption is enabled

- Tried Firefox and IE10

When I attempt to run the ASDM via the browser I get as far as asking for the password and although the initial prompt seems to accept it, another authentication box appears asking for it over and over again in an endless loop.

I have been through many forum posts and check lists, but cannot seem to pinpoint this problem.

If it helps, the box was previously flashed back to factory-default before I then applied the configuration from scratch (based on the config of our live ASA 5510).

Can somebody help please?

Thanks

Unable to launch Device Manager - ASDM issue

pubhanda — Tue, 28 Jan 2014 15:28:26 GMT

Hi Anthony,

Could you please send me the output of "show run aaa", "show run all ssl".

Also Please confirm the JAVA version, is it JAVA 7 update 5 or update 51.?

Thanks and Regards,

Pulkit Bhandari

Unable to launch Device Manager - ASDM issue

anthonyludlow — Tue, 28 Jan 2014 15:34:36 GMT

Firstly, sorry the Java version is infact Version 7 Update 51.

There is no output for "show run aaa"!!

CISCO-ASA-1(config)# show run all ssl

ssl server-version any

ssl client-version any

ssl encryption rc4-md5 rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1

ssl certificate-authentication fca-timeout 2

Thanks

Unable to launch Device Manager - ASDM issue

pubhanda — Tue, 28 Jan 2014 15:38:10 GMT

Hi Anthony,

Thanks for the outputs.

Please add the following command on the ASA and then test if it works for you.

aaa authentication http console LOCAL

Please let me know if it works and accept this reply as a solution.

Thanks ,

Pulkit Bhandari

Unable to launch Device Manager - ASDM issue

anthonyludlow — Tue, 28 Jan 2014 15:42:17 GMT

Pulkit Bhandari wrote:
Hi Anthony,
Thanks for the outputs.
Please add the following command on the ASA and then test if it works for you.
aaa authentication http console LOCAL
Please let me know if it works and accept this reply as a solution. 
Thanks ,
Pulkit Bhandari

Unfortunately I am still receiving the same issue with both the ASDM application and via the web browser.

Thanks

Unable to launch Device Manager - ASDM issue

pubhanda — Tue, 28 Jan 2014 15:51:22 GMT

Hi Anthony,

Could you please follow the below steps and add an exception in Java for the ASDM IP address becasue we have been seeing issues after JAVA 7 update 51. Please follow the below steps and the chek if it works for you.

Add a security exception for the ASA in the Java Control Panel, so that you could launch the current ASDM image and upgrade it from within ASDM:

- Open Java Control Panel

* on Windows: Start > Control Panel > Java Control Panel

* on Mac: click on Java icon in System Preferences

- Go to the Security tab

- In the Exception Site List section at the bottom, click Edit Site List and add the ASA you want to manage with ASDM:

https://>

where is the IP address of the ASA.

Please let me know if it works for you.

Thanks,

Pulkit Bhandari

Unable to launch Device Manager - ASDM issue

anthonyludlow — Tue, 28 Jan 2014 15:56:06 GMT

Pulkit Bhandari wrote:
Hi Anthony,
Could you please follow the below steps and add an exception in Java for the ASDM IP address becasue we have been seeing issues after JAVA 7 update 51. Please follow the below steps and the chek if it works for you.
Add a security exception for the ASA in the Java Control Panel, so that you could launch the current ASDM image and upgrade it from within ASDM:
     - Open Java Control Panel 
        * on Windows: Start > Control Panel > Java Control Panel
        * on Mac: click on Java icon in System Preferences
     - Go to the Security tab
     - In the Exception Site List section at the bottom, click Edit Site List and add the ASA you want to manage with           ASDM:
           https://>
         where  is the IP address of the ASA.
Please let me know if it works for you.
Thanks,
Pulkit Bhandari

I have already done this also Pulkit and additionally I have even temporarily decreased the Java security level to Medium, but still no good.

I have noticed in the Java logs when attempting to login to the ASDM app that there seems to be an issue with the Certificate, it says "Caused by: java.security.cert.CertificateException: Java couldn't trust Server"

I have also managed to use OpenSSL in order to get the certificate imported into the Trusted certificates within Java.

Thanks

Unable to launch Device Manager - ASDM issue

anthonyludlow — Wed, 29 Jan 2014 15:13:06 GMT

Any further ideas?

Thanks

Unable to launch Device Manager - ASDM issue

prateeve — Wed, 29 Jan 2014 16:09:20 GMT

Hi,

I would suggest you to downgrade the java to version 7 update 45. It should work after that.

- Prateek Verma

Re: Unable to launch Device Manager - ASDM issue

anthonyludlow — Wed, 29 Jan 2014 16:35:21 GMT

Prateek Verma wrote:

Hi,

I would suggest you to downgrade the java to version 7 update 45. It should work after that.

- Prateek Verma

Hi Prateek,

I have now downgraded my Java client to v7 Update 45 as you suggested, but I'm now being told that the password I'm entering for the ASDM is invalid, which isn't the case!!

Any thoughts?

Unable to launch Device Manager - ASDM issue

prateeve — Wed, 29 Jan 2014 16:42:48 GMT

Hi Anthony,

Since, you must have following command on ASA:

aaa authentication http console LOCAL

Along with that , there should be a username and password in ASA's local database. So try to configure following command and then check:

username cisco password cisco

After this try to access ASDM with username and password both cisco and check whether it works or not.

- Prateek Verma

Re: Unable to launch Device Manager - ASDM issue

anthonyludlow — Thu, 30 Jan 2014 09:35:21 GMT

Prateek Verma wrote:

Hi Anthony,

Since, you must have following command on ASA:

aaa authentication http console LOCAL

Along with that , there should be a username and password in ASA's local database. So try to configure following command and then check:

username cisco password cisco

After this try to access ASDM with username and password both cisco and check whether it works or not.

- Prateek Verma

This suggestion worked Prateek as previously we'd never had a username configured on our device, so I presume something has been changed in the most recent firmware update which means that you HAVE to have a Username, would I be correct in saying that?

Thanks

Re: Unable to launch Device Manager - ASDM issue

stwilliams — Thu, 30 Jan 2014 21:29:42 GMT

An easier way to get around the problem of Java 7 update 51 and ASDM on Windows computers is to point your browser to https:// and chose the option to open ASDM as a Java Web Start Application. ADSM should then start fine and you won't have to downgrade Java and open up security holes that were patched in v. 51.

Then go to the Java control panel item and on the "General" tab under "Temporary Internet Files", click the "View" button, click once on the item with ASDM in it to select it and then click the top row icon that looks like an arrow pointing up and to the right. This will place a shortcut to open the ASDM on your desktop. Suggest you then delete the old desktop icon for starting ASDM as a local app since that no longer works anyway.

Sent from Cisco Technical Support iPad App

Unable to launch Device Manager - ASDM issue

scrye — Wed, 12 Feb 2014 21:35:45 GMT

" ...

click once on the item with ASDM in it to select it and then click the top row icon that looks like an arrow pointing up and to the right. "

This does not work for me because the arrow is greyed-out. BTW I hate java ...

Steve

Unable to launch Device Manager - ASDM issue

stwilliams — Thu, 13 Feb 2014 20:29:05 GMT

That's interesting. I went back in and now the arrow icon is greyed out on my computer too - but then I already have the shortcut it previously created on my desktop. I could remove the shortcut and see if the arrow is no longer greyed out but don't want to risk not being able to recreate it. I hate Java too but have some apps that require it - like Cisco ASDM.

You can still start ASDM with Java 7 update 51 on your computer by browsing to https:// and choosing "Java Web Start". IMHO that's way better than Cisco's solution of downgrading the Java version and leaving yourself open to security issues that version 51 (and later) have patched.

Re: Unable to launch Device Manager - ASDM issue

scrye — Thu, 13 Feb 2014 22:21:20 GMT

Ok, here is something odd. I just now looked on my desktop for the first time in several days (it is normally hidden by a gaggle of open windows), and there was an icon that sure looks like it was created when I tried what you described - even though the icons was greyed out. Or perhaps the mere act of launching the Java Web Start created it??

The Target for the icon is:

C:\Windows\SysWOW64\javaws.exe -localfile "C:\Users\xxxxxx\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\70b3fe2b-31e71a37"

and the Start In is blank.

When I launch it, sure enough it brings up the Java WebStart style ASDM launcher, which is different from the stand-alone version that is broken by the new JAVA 7.whatever.

Puzzled,

Steve

Re: Unable to launch Device Manager - ASDM issue

stwilliams — Thu, 13 Feb 2014 22:40:48 GMT

I'm pretty sure it created the icon on your desktop when you first clicked the arrow. As I recall, when I first added the shortcut by clicking the arrow icon nothing apparent seemed to happen, but I looked at my desktop and there it was.

Glad it worked for you!

Hi Anthony,I had this same

nypizzar0x — Thu, 13 Mar 2014 19:47:26 GMT

Hi Anthony,

I had this same issue. I resolved it by opening Java (Windows - Control Panel Java - Select Security Tab Select Manage Certificates. Select Certificate Type and choose Secure Site) on a known working ASDM installed computer.

Export the "Trusted Site" cert and import it on the computer with ASDM issue.

This resolved the issue for

Joel Asaro — Wed, 26 Mar 2014 19:13:16 GMT

This resolved the issue for me. I exported the self-signed certificates from each of my ASAs and then imported them into the "secure site" section in Java console (the "trusted certificates" section did not work). I have seen this previously for another java application as well. This was with ASDM 7.1(5)100 and Java version 7 update 51.

@ Joel Asaro:thanks man. you

krs4keshara — Thu, 10 Apr 2014 09:15:58 GMT

@ Joel Asaro:

thanks man. you saved my day...