topic Re: Unable to access ASA 5520 using HTTP/HTTPS in Network Security

Unable to access ASA 5520 using HTTP/HTTPS

VincentLong — Tue, 18 Jul 2023 05:26:54 GMT

I was unable to access my ASA 5520 using HTTP/HTTPS even on the management interface. I had upgrade the ASA IOS to asa832-k8.bin and ASDM to asdm-634-53.bin. But, the issue still the same.

My browser show the error message as attach image.

PGA-Firewall-02# sh run
: Saved
:
ASA Version 8.3(2)
!
hostname PGA-Firewall-02
enable password xxx encrypted
passwd xxx encrypted
names
!
interface GigabitEthernet0/0
nameif public
security-level 0
ip address 192.168.50.6 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 172.16.0.6 255.255.0.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
description LAN Failover Interface
shutdown
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.80.1 255.255.255.0
management-only
!
boot system disk0:/asa832-k8.bin
ftp mode passive
dns domain-lookup public
dns server-group DefaultDNS
name-server 202.188.0.133
name-server 202.188.1.5
name-server 165.21.83.88
name-server 8.8.8.8
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network my-inside-net
subnet 172.16.0.0 255.255.0.0
access-list LAN_access_in extended permit ip any any
pager lines 24
mtu public 1500
mtu inside 1500
mtu management 1500
failover
failover lan unit secondary
failover lan interface failover GigabitEthernet0/3
failover key *****
failover interface ip failover 192.168.100.1 255.255.255.0 standby 192.168.100.2

icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-634-53.bin
no asdm history enable
arp timeout 14400
!
object network my-inside-net
nat (inside,public) dynamic interface
access-group LAN_access_in in interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable 7070
http 0.0.0.0 0.0.0.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.80.10-192.168.80.254 management
dhcpd dns 8.8.8.8 202.188.0.133 interface management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username admin password xxx encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DD
CEService
destination address email xxx
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:xxx
: end
PGA-Firewall-02#

Re: Unable to access ASA 5520 using HTTP/HTTPS

Herbert Baerten — Sun, 12 Dec 2010 21:21:24 GMT

Hi Vincent,

Most commonly this is because the ASA does not have a 3DES/AES license , please check "show version | incl 3DES".

If this says "disabled" then go to http://www.cisco.com/go/license to request a license (should be free of charge, but can only be requested if you are not in any country to which the US has export restrictions).

hth

Herbert

Re: Unable to access ASA 5520 using HTTP/HTTPS

VincentLong — Tue, 22 Mar 2011 07:39:34 GMT

Hi,

After i apply the license i get from Cisco and it still don't work. i had attached the sh run and sh tech for both units. Please kindly advice.

Re: Unable to access ASA 5520 using HTTP/HTTPS

VincentLong — Wed, 06 Apr 2011 04:16:27 GMT

Anyone facing the same issue as mine? Anyone know about the root cause of this issue?

Re: Unable to access ASA 5520 using HTTP/HTTPS

Richard Burts — Wed, 06 Apr 2011 06:09:24 GMT

Vincent

Perhaps there is something more complicated involved here that I have not yet recognized. But I see some fairly simple things that may explain your difficulty.

First let us look at what is allowed to use the HTTP access:

http 0.0.0.0 0.0.0.0 management

This says that any source address is permitted to access the management address. And the management address is

192.168.80.1. But in the examples of the error messages that were in your post they were not attempting to access 192.168.80.1.

So my first suggestion is to ask what happens if you attempt HTTP/STTPS to 192.168.80.1 rather than to some other address in that subnet.

My second suggestion is to ask where you are attempting HTTP/HTTPS access from? Does your source have network connectivity to 192.168.80.1 connecting on the management interface (not on the inside interface)?

My third suggestion would be to suggest that you enable HTTP/HTTPS access to the Inside interface address from source addresses of the inside network.

http 172.16.0.0 255.255.0.0 inside

Give these a try and let us know what happens.

HTH

Rick

Re: Unable to access ASA 5520 using HTTP/HTTPS

VincentLong — Wed, 06 Apr 2011 06:54:25 GMT

Hi,

The print screen i attached was when i access to the management interface of Firewall-02 which it management interface IP address is 192.168.80.2. I had tried to access to both firewall 1 and firewall-2 management interface after applied the ASA 3DES license key which i get from Cisco. The result was the same. I don't know whether is my configuration issue or other unknown issue.

I had attached the diagram of the network which shown how the connection of firewall. Meanwhile i also hope that someone can teach me on how to configure HA using command line as at the moment i can't the ASDM. I had search on Cisco website and they mention about context. I got few question for that as below:

1. What is it about?

2. Why we need to create 2 context in 1 firewall?

Many thanks in advance.

Re: Unable to access ASA 5520 using HTTP/HTTPS

Shrikant Sundaresh — Thu, 07 Apr 2011 20:57:35 GMT

Hi Vincent,

The issue is not that complex, and is frequently encountered.

Please refer to this document I wrote on troubleshooting ASDM access, as you are facing the exact same issue.

https://supportforums.cisco.com/docs/DOC-15016#Weak_Encryption

Hope this helps.

-Shrikant

P.S.: Please mark the question resolved, if it has been answered. Do rate helpful posts. Thanks

Re: Unable to access ASA 5520 using HTTP/HTTPS

VincentLong — Fri, 08 Apr 2011 03:42:30 GMT

Hi Shrikant Sundaresh,

I will try the recommendation solution in your post and will update you whether it work or not as the firewall is install at project side far from my current location. I will only go there again in 2 week time. Anyway, many thanks in advance.

Re: Unable to access ASA 5520 using HTTP/HTTPS

Noman Yousaf — Wed, 14 Jun 2023 08:15:46 GMT

Hi schrikant, Can you please upload this documents on any other drive. Because i cant access this document on Cisco Page.

Re: Unable to access ASA 5520 using HTTP/HTTPS

Jinu George — Mon, 17 Jul 2023 16:30:12 GMT

https://community.cisco.com/t5/security-knowledge-base/asdm-access-troubleshooting/ta-p/3122148