UNABLE TO ACCESS PIX515E VIA ASDM

Jean Paul Enerst — Mon, 11 Mar 2019 19:15:22 GMT

Hi all,

I have a basic config on the device, the ASDM was working fine untill i modify a NAT rule. Since then I am unable to access the device with asdm 61551, I have tried to upgrade to asdm 603, but get other issue with it as per below

SNAFLAB01(config)# copy tftp: flash:

Address or name of remote host [192.168.23.27]?

Source filename [asdm-603.bin]?

Destination filename [asdm-603.bin]?

Accessing tftp://192.168.23.27/asdm-603.bin...
WARNING: TFTP download incomplete!

%Error reading tftp://192.168.23.27/asdm-603.bin (Unspecified Error)
SNAFLAB01(config)#

PIX is can ping TFTP SERVER,and TFTP server can ping pix back.

There is the basic PIX config

: Saved
:
PIX Version 8.0(4)
!
hostname SNAFLAB01
enable password F.MMy3dfjSesZjVs encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address dhcp
!
interface Ethernet1
speed 100
duplex full
nameif inside
security-level 100
ip address 192.168.23.2 255.255.255.0
!
interface Ethernet2
nameif DMZ24
security-level 80
ip address 192.168.24.1 255.255.255.0
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet5
shutdown
no nameif
no security-level
no ip address
!
boot system flash:/image.bin
ftp mode passive
same-security-traffic permit intra-interface
access-list inside_access_in extended permit icmp 192.168.23.0 255.255.255.0 192.168.24.0 255.255.255.0
access-list inside_access_in extended permit ip 192.168.23.0 255.255.255.0 192.168.24.0 255.255.255.0
access-list inside_access_in extended permit ip 192.168.23.0 255.255.255.0 any
access-list outside_access_in extended permit ip 172.16.0.0 255.255.0.0 192.168.23.0 255.255.255.0
access-list outside_access_in extended permit icmp 192.168.24.0 255.255.255.0 192.168.24.0 255.255.255.0
access-list DMZ24_access_in extended permit icmp 192.168.24.0 255.255.255.0 192.168.23.0 255.255.255.0
pager lines 24
logging enable
logging buffered debugging
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu DMZ24 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit 172.16.0.0 255.255.0.0 outside
icmp permit any inside
icmp permit 192.168.23.0 255.255.255.0 inside
asdm image flash:/asdm-603.bin
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 101 0.0.0.0 0.0.0.0
static (outside,inside) interface 74.210.56.28 netmask 255.255.255.255
static (DMZ24,inside) 192.168.24.0 192.168.23.0 netmask 255.255.255.0
static (inside,DMZ24) 192.168.23.0 192.168.23.0 netmask 255.255.255.0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group DMZ24_access_in in interface DMZ24
route outside 0.0.0.0 0.0.0.0 74.210.56.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.23.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 192.168.23.5 255.255.255.255 inside
telnet 192.168.23.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.23.5 255.255.255.255 inside
ssh 192.168.23.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username crazydonjuan password oRCgyJTjAIKhgirc encrypted
!
class-map global-class
match default-inspection-traffic
!
!
policy-map global-policy
class global-class
inspect ctiqbe
inspect icmp
inspect icmp error
!
service-policy global-policy global
prompt hostname context
Cryptochecksum:cd485f4ab354b64952e933755e1b793f
: end
SNAFLAB01(config)#

SNAFLAB01(config)# sh asp table socket

Protocol Socket    Local Address               Foreign Address         State
SSL       000050dc 192.168.23.2:443            0.0.0.0:*               LISTEN
TCP       0000b694 192.168.23.2:23             0.0.0.0:*               LISTEN
TCP       00015c34 192.168.23.2:22             0.0.0.0:*               LISTEN
SNAFLAB01(config)#

Directory of flash:/

7 -rw- 7495736 00:48:09 Nov 09 2010 image.bin
11 -rw- 7605252 01:07:50 Nov 09 2010 asdm-61551.bin

Thanks,

Jean Paul

Re: UNABLE TO ACCESS PIX515E VIA ASDM

Jennifer Halim — Sat, 27 Nov 2010 22:55:14 GMT

You might want to remove the following static NAT statement as it will cause you a lot of issues:

static (outside,inside) interface 74.210.56.28 netmask 255.255.255.255

Then "clear xlate" after removing the above. You should have access to ASDM again.

This is not a supported configuration NATing the inside interface 1:1 to a public ip address.

topic UNABLE TO ACCESS PIX515E VIA ASDM in Network Security

UNABLE TO ACCESS PIX515E VIA ASDM

Re: UNABLE TO ACCESS PIX515E VIA ASDM