topic Re: ASDM unable to reach device in Network Security

ASDM unable to reach device

TechnicalEE — Fri, 21 Feb 2020 17:34:56 GMT

Hello All,

I have 13 ASA's and the ASDM is able to reach all of them except one.

I have went through all the troubleshooting and all the forum answers on here and it still isnt reachable.

Can someone recommend anything?

Thanks in advance,

Re: ASDM unable to reach device

balaji.bandi — Fri, 11 Oct 2019 16:57:51 GMT

what is the configuration on that ASA, just compare the config or post the configuraiton which was not working to have look ?

what is the error you getting while connecting using ASDM, what is the ASA version / Model of the device ?

Re: ASDM unable to reach device

TechnicalEE — Fri, 11 Oct 2019 17:02:32 GMT

Hi @balaji.bandi here is the info.

Cisco Adaptive Security Appliance Software Version 9.6(3)1
Device Manager Version 7.7(1)150

ASA is a 5506

The error i am getting is ASDM unable to launch device manager from x.x.x.x

x.x.x.x is the IP address removed for Security

Here is the Java Log:

java.net.ConnectException: Connection timed out: connect
at java.net.DualStackPlainSocketImpl.connect0(Native Method)
at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
at java.net.PlainSocketImpl.connect(Unknown Source)
at java.net.SocksSocketImpl.connect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
at sun.security.ssl.BaseSSLSocketImpl.connect(Unknown Source)
at sun.net.NetworkClient.doConnect(Unknown Source)
at sun.net.www.http.HttpClient.openServer(Unknown Source)
at sun.net.www.http.HttpClient.openServer(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.New(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
at com.cisco.launcher.y.a(Unknown Source)
at com.cisco.launcher.y.if(Unknown Source)
at com.cisco.launcher.r.a(Unknown Source)
at com.cisco.launcher.s.do(Unknown Source)
at com.cisco.launcher.s.null(Unknown Source)
at com.cisco.launcher.s.new(Unknown Source)
at com.cisco.launcher.s.access$000(Unknown Source)
at com.cisco.launcher.s$2.a(Unknown Source)
at com.cisco.launcher.g$2.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Trying for IDM. url=https://x.x.x.x/idm/idm.jnlp/
java.net.ConnectException: Connection timed out: connect
at java.net.DualStackPlainSocketImpl.connect0(Native Method)
at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
at java.net.PlainSocketImpl.connect(Unknown Source)
at java.net.SocksSocketImpl.connect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
at sun.security.ssl.BaseSSLSocketImpl.connect(Unknown Source)
at sun.net.NetworkClient.doConnect(Unknown Source)
at sun.net.www.http.HttpClient.openServer(Unknown Source)
at sun.net.www.http.HttpClient.openServer(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.New(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)
at com.cisco.launcher.w.a(Unknown Source)
at com.cisco.launcher.s.for(Unknown Source)
at com.cisco.launcher.s.new(Unknown Source)
at com.cisco.launcher.s.access$000(Unknown Source)
at com.cisco.launcher.s$2.a(Unknown Source)
at com.cisco.launcher.g$2.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

Thank you,

Re: ASDM unable to reach device

balaji.bandi — Fri, 11 Oct 2019 18:27:01 GMT

All ASA same version working and not working one?

what is the java version you have installed?

when you type on browser https://asaipaddress ? what is the outcome?

Re: ASDM unable to reach device

TechnicalEE — Fri, 11 Oct 2019 18:41:05 GMT

This ASA is an older version i was trying to upgrade it but cant reach asdm and cant tftp the image into it.

The site cant be reached is what i get.

Using JRE version 1.8.0_221 Java HotSpot(TM) Client VM

Thanks for your help,

Re: ASDM unable to reach device

Marius Gunnerud — Fri, 11 Oct 2019 19:18:07 GMT

issue the command show ssl cipher on an ASA that is working and then compare that with the ssl cipher on the ASA that is not working (if it is an ASA version older than 9.3 use the command show ssl encryption). If they are a little different add the missing ciphers to the ASA that ASDM doesnt work on.

Re: ASDM unable to reach device

TechnicalEE — Fri, 11 Oct 2019 19:34:07 GMT

Hi @Marius Gunnerud, thanks for the advice. I compared it to a working one and it was missing a cipher. I did add it and it still isn't connecting. Still showing the same error.

Thank you,

Re: ASDM unable to reach device

Marius Gunnerud — Fri, 11 Oct 2019 19:51:07 GMT

Which browser are you using? Have you tried a different browser?

Are you able to SSH to the device? if yes, can you issue the commands sh run asdm, show run http, dir, show run aaa.

Also, are you able to reach the ASA via https in a browser? https://192.168.1.1/admin (if you are running AnyConnect VPN you need the /admin to reach the ASDM installation screen). Try uninstalling ASDM from your machine and installing the ASDM client from the ASA that is not working (or better yet, if you have a spare PC you can install ASDM on use that one)

Re: ASDM unable to reach device

TechnicalEE — Fri, 11 Oct 2019 19:56:51 GMT

Hi @Marius Gunnerud

Here is the info.

ASA# sh run asdm
asdm image disk0:/asdm-771-150.bin
no asdm history enable
ASA# sho run http
http server enable
http 192.168.1.0 255.255.255.0 outside-backup
http 192.168.2.0 255.255.255.0 outside
ASA# dir

Directory of disk0:/

104 -rwx 86456832 19:18:58 Feb 10 2017 asa961-lfbff-k8.SPA
105 -rwx 25819140 19:19:28 Feb 10 2017 asdm-761.bin
106 -rwx 62 14:29:24 Oct 11 2019 .boot_string
11 drwx 4096 19:22:30 Feb 10 2017 log
23 drwx 4096 19:23:22 Feb 10 2017 crypto_archive
107 -rwx 4096 18:00:00 Dec 31 1979 FSCK0000.REC
108 -rwx 4096 18:00:00 Dec 31 1979 FSCK0001.REC
24 drwx 4096 19:26:44 Feb 10 2017 coredumpinfo
109 -rwx 84541616 06:45:18 Apr 09 2017 asa963-1-lfbff-k8.SPA
110 -rwx 41846784 06:45:32 Apr 09 2017 asasfr-5500x-boot-6.2.0-2.img
111 -rwx 26729944 06:46:02 Apr 09 2017 asdm-771-150.bin

7365472256 bytes total (3876720640 bytes free)

#ASA# sho run aaa
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
aaa authentication enable console LOCAL
aaa authorization command LOCAL

I am not able to reach it with a browser from my machine or from a local machine at that office.

I have uninstalled and installed the ASDM already.

I am now at this point where I cant figure out what it could be.

Thanks again,

Re: ASDM unable to reach device

Marius Gunnerud — Fri, 11 Oct 2019 20:00:05 GMT

Are you able to do a reboot of the ASA? It is possible there is some process which is hanging.

Re: ASDM unable to reach device

TechnicalEE — Fri, 11 Oct 2019 20:01:42 GMT

@Marius Gunnerud I can reboot it later after hours and see if that fixes anything.

I will update soon.

Thank you for your help thus far,

Re: ASDM unable to reach device

TechnicalEE — Tue, 15 Oct 2019 14:59:27 GMT

Hi @Marius Gunnerud I rebooted the ASA and i still cant get the ASDM to open for that ASA.

Any help is appreciated.

Thank you,

Elvir

Re: ASDM unable to reach device

Marius Gunnerud — Tue, 15 Oct 2019 19:57:53 GMT

Do you by chance have a NAT statement for port tcp/443 on the affected ASA?

Re: ASDM unable to reach device

TechnicalEE — Tue, 15 Oct 2019 20:34:57 GMT

@Marius Gunnerud there is not a nat statement for TCP?443

Re: ASDM unable to reach device

Marius Gunnerud — Wed, 16 Oct 2019 05:06:26 GMT

Could you provide us with the output of show route interface outside and show route interface outside-backup as well as show int ip brief. remember to remove any public IPs.

Also, which IP / subnet are you trying to reach the ASA from?

Re: ASDM unable to reach device

TechnicalEE — Wed, 16 Oct 2019 13:48:23 GMT

Hi @Marius Gunnerud

Here is outside:

Gateway of last resort is 1.1.1.1 to network 0.0.0.0

S* 0.0.0.0 0.0.0.0 [1/0] via 1.1.1.1, outside
S 4.2.2.2 255.255.255.255 [1/0] via 1.1.1.1, outside
C 1.1.1.1 255.255.255.224 is directly connected, outside
L 1.1.1.1 255.255.255.255 is directly connected, outside

Here is outside-backup:

Gateway of last resort is 1.1.1.1 to network 0.0.0.0

S 8.8.8.8 255.255.255.255 [1/0] via 2.2.2.2, outside-backup
C 2.2.2.2 255.255.255.252 is directly connected, outside-backup
L 2.2.2.2 255.255.255.255 is directly connected, outside-backup

And here is sho int ip brief:

ASA5506# sho int ip brief
Interface IP-Address OK? Method Status Protocol
Virtual0 127.1.0.1 YES unset up up
GigabitEthernet1/1 1.1.1.1 YES CONFIG up up
GigabitEthernet1/2 2.2.2.2 YES CONFIG up up
GigabitEthernet1/3 192.168.20.1 YES CONFIG up up
GigabitEthernet1/4 192.168.120.1 YES CONFIG up up
GigabitEthernet1/5 10.254.254.1 YES CONFIG up up
GigabitEthernet1/6 unassigned YES unset administratively down down
GigabitEthernet1/7 unassigned YES unset administratively down down
GigabitEthernet1/8 unassigned YES unset administratively down down
Internal-Control1/1 127.0.1.1 YES unset up up
Internal-Data1/1 unassigned YES unset up up

I am going from a 192.168.30.0 subnet to 192.168.20.0 subnet. Different office, different state. I rebooted it again last night and still cant reach it.

Thanks,

E
Internal-Data1/2 unassigned YES unset up up
Internal-Data1/3 unassigned YES unset up up
Internal-Data1/4 169.254.1.1 YES unset up up
Management1/1 unassigned YES unset up up
NorthVa5506#

Re: ASDM unable to reach device

Marius Gunnerud — Wed, 16 Oct 2019 14:07:49 GMT

Is 192.168.30.0/24 coming in over a VPN connection on the outside interface? If yes, do you have the command management-access <interface> where interface is the interface name of the interface you are trying to connect to?

You do not have the 192.168.30.0/24 subnet defined in you http list

ASA# sho run http
http server enable
http 192.168.1.0 255.255.255.0 outside-backup
http 192.168.2.0 255.255.255.0 outside

If you are accessing the interface with IP 192.168.20.1 then you would need to add the command http 192.168.30.0 255.255.255.0 <interface name> where interface name is the name of the interface you are trying to connect to as well as management-access command I mentioned earlier.

Re: ASDM unable to reach device

TechnicalEE — Wed, 16 Oct 2019 14:39:58 GMT

Hi @Marius Gunnerud you are the man.

I added the http 192.168.30.0 inside on the target ASA and it worked.

I have ASDM pulled up and I am able to upgrade the image.

Thank you very much,