Can't login to ASDM

[joescott4t]

Hello,

I am having issue logging into my Cisco ASA 5505 ASDM interface. It prompts for a username and password  but it will not authenticate. When I look at the http debug it tells me that authentication failed. I have tried with both username and password as well as with just a password. Please help, thanks.

[joescott4t]

I CAN login to the cli.

[Marvin Rhoads]

Has it ever worked?

Typically I wold look for a line like "aaa authentication http console LOCAL" in the configuration (assuming you are using local authentication). Basically you should match the line you have for "aaa ssh authentication..."

[joescott4t]

I don't know if it ever worked I have inherited the device. I beleive that I added that line to the config as I wanted to use the LOCAL database. When I use the launcher it prompts me twice to log in.

[paulstone80]

Just checked the config on my ASA's and the only commands I have for asdm access are:

http server enable xxxx

http x.x.x.x x.x.x.x inside

I also authenticate using a local account when using ASDM.

I would try removing  'aaa authentication http LOCAL' and see if that works.

HTH

Paul

[joescott4t]

How can i safely remove that without affecting my CLI access?

[Marvin Rhoads]

That command only affects ASDM access. It's not strictly necessary since by default ASDM (http access method) should fall back to LOCAL. (Reference)

If there is some other "aaa authentication http" command in your configuration that might give you problems if the other specified server group is unavailable.

If you could share your sanitized configuration with us, it would be much more productive than guessing what you may or may not have setup.

[subie86]

It appears a soulution was never provided. Though it's been many years since this thread, and with my inability to figure out how to post a new topic I would like to pursue an answer for this. 

I am having the same issue, I am not able to login to ASDM. It will not accept my username and password. I am running asa842-8-k8 and asdm-645-206. Is there a compatibility issue with the asa842 image ? If yes then I have my answer, if not then I am will to post a sanitized copy of my config. 

[jshdcooper]

Can you verify the ASDM image on the flash is the same in the running config?

You can check, show run asdm

[KevinGbs]

Just ran into this scenario myself (can't login to ASDM, CAN login to SSH). I encountered this after an upgrade of both the ASA and ASDM. Given it had been working and assuming it wasn't an inherent problem with the new versions I'd loaded I started looking for inconsistencies and found it.

I'd upgraded the ASDM bin file and removed the old one thinking that would cause it to use the new one. It would have if I hadn't had an asdm image file specified in the configuration referencing the deleted bin. I resolved this by removing the ASDM image command from the configuration. This then resulted in the behavior I had anticipated... it used the latest (only) ASDM image on the system and I was back in business.

Specifically, I ran 'no asdm image' to relieve this self-inflicted pain.

[felipe.bsilva]

Thank you friend.

That solved it for me.

"asav-lab(config)# no aaa authentication http console LOCAL"

[NIKHIL M K]

Thank you so much 
I was on ASA5555 and got a username and password error while accessing via ASDM after ASA upgrade. The CLI mode was working and run "asav-lab(config)# no aaa authentication http console LOCAL" then I got my access back.

[hslai]

The change appears due to CSCvz92016, which associated with the security advisory https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-mgmt-privesc-BMFMUvye

And documented at Configure HTTPS Access for ASDM, Other Clients 

Also see CSCwb67583

[loizosko]

it lets you login without credentials though.

i had same issue after going to the latest asdm.

when i put that command to remove the authentication for asdm i was able to launch without credentials.

the solution i found was to specify a port other than 443.

"http server enable 8443" for example

[Giovanni Alexander Molina]

Try checking if your ip address haves the permision to administrate, you can check by console cable and if not just add the next line:

ssh 10.30.1.X 255.255.255.255 inside
https 10.30.1.X 255.255.255.255 inside

also see by console if the username exists.

good luck!