Hello everyone
I need your help regarding an ASA 5505 ASDM "Connection timed out: connect" issue
It is a Lab purpose with 3 devices: 1 PC, 1 Switch and 1 ASA
- PC Npcap Loopback interface (192.168.1.20) is connected to the switch 0/3 interface
- Switch 0/6 interface is connected to the ASA's 0/1 interface
- Switch 0/3 interface is connected to the Internet box which is 192.168.1.10
That means that ASA is not linked to internet, only the switch is connected to the ASA and I have Internet access from my PC.
My goal is to access the ASDM in order to configure Radius and VPNs using VMs running on my PC (in the 192.168.1.0 network).
PC IP's address: 192.168.1.18
ASA's IP address: 192.168.1.1
Internet provider box: 192.168.1.10
=> I can perfectly ping from PC to ASA Ethernet0/1 interface.
Below the SWITCH configuration:
switch1#show running-config
Current configuration : 2442 bytes
!
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname switch1
!
boot-start-marker
boot-end-marker
!
!
!
!
no aaa new-model
system mtu routing 1500
!
!
!
!
crypto pki trustpoint TP-self-signed-1285250688
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1285250688
revocation-check none
rsakeypair TP-self-signed-1285250688
!
!
crypto pki certificate chain TP-self-signed-1285250688
certificate self-signed 01
262AC977 DB20DA05 F4B3310D D9F49534 98D080D7 0CF33936 24E75088 6CAC991F CCE0AA2D
quit
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
interface FastEthernet0/1
!
interface FastEthernet0/2
!
interface FastEthernet0/3
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface GigabitEthernet0/1
!
interface Vlan1
ip address 192.168.1.2 255.255.255.0
!
ip default-gateway 192.168.2.254
ip http server
ip http secure-server
!
line con 0
line vty 0 4
login
line vty 5 15
login
!
end
Interface VLAN 1 is not used apparently
I tried to put interface 0/3 and 0/6 in the VLAN2 but it doesn't work (i lost connection to the ASA).
===================================
ASA's configuration:
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
shutdown
!
interface Ethernet0/1
switchport access vlan 1
!
interface Ethernet0/2
shutdown
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
interface Vlan1
nameif inside
no security-level
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
no nameif
no security-level
no ip address
!
interface Vlan3
no nameif
no security-level
no ip address
!
ftp mode passive
dns domain-lookup outside
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network LAN-PRIVE
subnet 192.168.1.0 255.255.255.0
description Lan prive
access-list RESEAU_PRIVE_access_in extended permit icmp any any
access-list RESEAU_PRIVE_access_in extended permit ip any any
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu DMZ 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network obj_any
nat (inside,outside) dynamic interface
access-group RESEAU_PRIVE_access_in in interface inside
access-group RESEAU_EXTERNE_access_in in interface outside
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 outside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection scanning-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl server-version any
username cisco password ffIRPGpDSOJh9YLq encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:7e849f772a4f1c59f2a194501ca264b6
: end
exit
interface Ethernet 0/1
no shutdown
wr mem
When trying to launch Cisco ASDM-IDM Launcher, I have the following error message: "unable to launch device manager from 192.168.1.1"
When checking the Java's log I get :
Trying for IDM. url=https://192.168.1.1/idm/idm.jnlp/
java.net.ConnectException: Connection timed out: connect
at java.net.DualStackPlainSocketImpl.connect0(Native Method)
at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
at java.net.PlainSocketImpl.connect(Unknown Source)
at java.net.SocksSocketImpl.connect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
at sun.security.ssl.BaseSSLSocketImpl.connect(Unknown Source)
at sun.net.NetworkClient.doConnect(Unknown Source)
at sun.net.www.http.HttpClient.openServer(Unknown Source)
at sun.net.www.http.HttpClient.openServer(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.New(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)
at com.cisco.launcher.w.a(Unknown Source)
at com.cisco.launcher.s.for(Unknown Source)
at com.cisco.launcher.s.new(Unknown Source)
at com.cisco.launcher.s.access$000(Unknown Source)
at com.cisco.launcher.s$2.a(Unknown Source)
at com.cisco.launcher.g$2.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
I've added the below addresses in the Java's security tab but it still doesn't work.
https://192.168.1.1
https://192.168.1.1/idm/idm/jnlp
https://192.168.1.1/admin/public/index.html
Could you plese help me ?
In advance, I thank you for your replies.
Damien
