topic Re: ASDM Issues in Network Security

ASDM Issues

Kemal Zuko — Tue, 12 Mar 2019 03:21:31 GMT

After I managed to install ASDM sucesfully thanks to (JouniForss ) I am running into another problem

I am not able to load the asdm on my computer

I did the follwoing

http 10.250.100.140 255.255.255.255 DMZ

http server enable

the DMZ interface is my uplink to a router. The DMZ looks like this

interface gi0/2

ip address 10.250.0.5 255.255.255.252

nameif DMZ

security-level 75

exit

on my other router I have setup a LAN of 10.250.100.128/25

.129 being my gateway for my PC

.140 being my PC

All routes are being learned via EIGRP

-------- ASA -------

ASA(config)# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 75.132.0.1 to network 0.0.0.0

D    192.168.250.0 255.255.255.248 [90/28416] via 10.250.0.2, 3:44:37, inside
D    10.250.100.128 255.255.255.128 [90/28416] via 10.250.0.6, 1:12:09, DMZ
D    10.250.100.0 255.255.255.128 [90/28416] via 10.250.0.2, 3:44:37, inside
D    10.250.1.1 255.255.255.255 [90/130816] via 10.250.0.6, 1:11:33, DMZ
C    10.250.0.0 255.255.255.252 is directly connected, inside
C    10.250.0.4 255.255.255.252 is directly connected, DMZ
C    1.1.1.2 255.255.192.0 is directly connected, outside
d*   0.0.0.0 0.0.0.0 [1/0] via 1.1.1.1, outside
ASA(config)#

router eigrp 99
no auto-summary
eigrp router-id 10.250.0.5
eigrp stub connected
network 10.250.0.0 255.255.255.252
network 10.250.0.4 255.255.255.252
network 10.250.1.0 255.255.255.252
network 10.250.100.0 255.255.255.128
network 10.250.100.128 255.255.255.128
network 10.250.150.0 255.255.255.0
network 10.250.160.0 255.255.255.248
passive-interface default
no passive-interface inside
no passive-interface DMZ

asdm image disk0:/asdm-715.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (DMZ,outside) source dynamic any interface
nat (inside,outside) source dynamic any interface

------------------------------------

Basicly this is all the confoguration I have. As you can see from the output of "show route" that 10.250.100.128/25 is being learned via the DMZ interface

However when I go to my browser and type in http://10.250.0.5 I get nothing

Thanks

And Happy Holidays

ASDM Issues

Jouni Forss — Tue, 24 Dec 2013 17:08:43 GMT

Hi,

Try to connect with HTTPS

https://10.250.0.5/

If that doesnt work then confirm that the ASA is listening on the port TCP/443 on the DMZ interface

show asp table socket

If it seems normal then check the following output

show run all ssl

You could copy/paste that output here or try the following configuration

ssl server-version any

ssl client-version any

ssl encryption rc4-sha1 aes128-sha1 aes256-sha1

- Jouni

ASDM Issues

Kemal Zuko — Tue, 24 Dec 2013 17:17:00 GMT

I tried https:// but that didint work eather

here is what I got from the table socket output

Protocol Socket State Local Address Foreign Address

SSL 000098c8 LISTEN 10.250.0.5:443 0.0.0.0:*

with the added commands you sent me didnt work eather

ASDM Issues

Jouni Forss — Tue, 24 Dec 2013 17:32:45 GMT

Hi,

Do you see anything in the log buffer (through the CLI) when you attempt to connect to the ASA with the browser? Have you tried some other browsers? Have you saved the configurations to the ASA and reloaded it?

- Jouni

ASDM Issues

zalkurdi — Tue, 24 Dec 2013 17:46:02 GMT

Hello,

Make sure that this command is present on the ASA:

"Crypto key generate rsa modulus 1024"

Also, make sure that the traffic is reaching the ASA. You mentioned that you have the DMZ interface connected to a router. Maybe the router is routing the trafffic somewhere else.

To make sure, you can run some packet captures on the DMZ interface by using the following commands:

"cap capin interface DMZ match ip host 10.250.100.140 host 10.250.0.5"
Then try to access the ASA from the PC using the browser and then use the command "show cap capin".

This will show if the packets are infact reaching the ASA.

ASDM Issues

Kemal Zuko — Tue, 24 Dec 2013 17:49:20 GMT

here is what I see in the Loggs

%ASA-3-710003: TCP access denied by ACL from 10.250.0.6/59245 to DMZ:10.250.0.5/80

%ASA-3-710003: TCP access denied by ACL from 10.250.0.6/59247 to DMZ:10.250.0.5/443

%ASA-3-710003: TCP access denied by ACL from 10.250.0.6/59247 to DMZ:10.250.0.5/443 %ASA-3-710003: TCP access denied by ACL from 10.250.0.6/59245 to DMZ:10.250.0.5/80
%ASA-3-710003: TCP access denied by ACL from 10.250.0.6/59245 to DMZ:10.250.0.5/80
%ASA-3-710003: TCP access denied by ACL from 10.250.0.6/59247 to DMZ:10.250.0.5/443
%ASA-3-710003: TCP access denied by ACL from 10.250.0.6/59247 to DMZ:10.250.0.5/443
%ASA-3-710003: TCP access denied by ACL from 10.250.0.6/59247 to DMZ:10.250.0.5/443

I am not very good at creating access lists on the cli any advice?

Re: ASDM Issues

Jouni Forss — Tue, 24 Dec 2013 18:25:10 GMT

Hi,

Seems to me that you are doing Dynamic PAT on the router perhaps?

Since the traffic is seen coming from the same IP address that is advertising the PC network to your ASA.

You could add

http 10.250.0.6 255.255.255.255 DMZ

To your ASA and try again.

If it works then you have to consider checking the NAT configuration on the router if you want the users to show up with their original IP address rather than the PAT IP address of the router.

- Jouni

ASDM Issues

Kemal Zuko — Tue, 24 Dec 2013 19:12:46 GMT

That did it thank you again.

Yes, I am douing dynamic PAT since I only have a single IP address from our provider. I know this is not the best way of douing this but for practice work its not too bad.

Thanks again and happy holidays