ASA 5510 getting file via HTTPS

[Icarus]

Hi Guys,

I have a little problem here. It might be an error on my side, but as it is with every error: I have no clue what is actually going wrong.

First, what I want to do: I want to be able log into my ASA5510 with Software Version 9.1(7)19, go to the system context and enter this command: copy https://username:password@server-ip//path/file flash:/filename

The path is actually correct. I can get this file from one of my C3750G and load it into my flash. When I do it with my ASA from the system context, I always get this error: "%Error opening https://username:password@server-ip//path/file (I/O error)"

If I do a term mon on this device, it shows me that "Device failed SSL handshake". When I capture the handshake, everything looks ok for my taste. I installed a CA certificate in the admin-context, which is just above the server certificate in the whole chain.

When I compare the capture from my C3750G and my ASA, it really looks the same. Both use TLSv1, both agree on one cipher suite with the server, but right after the capture says "Server Key Exchange", the ASA sends a TCP packet with the fin flag set and terminates the session. I really have no clue why this happens.

Is there some best practice on how to configure this? All I find if I search for "https" and "ASA" is the ASDM, and that is not what I am searching for. Even though the ASDM is working fine. Just saying. :)

Thank you in advance.

[Icarus · Accepted solution]

So, before anyone bothers helping me out: It seems, this is a more or (more) less well known problem. I stumbled across this topic here:

https://supportforums.cisco.com/t5/vpn/tls-1-2-on-asa-clientless-ssl-vpn/td-p/2173348

It seems, that the ASA up to version 9.3 have some weird difficulties with Diffie Hellman algorithms. After I set this command in the admin-context: "ssl encryption aes128-sha1 aes256-sha1 3des-sha1" it actually worked. Pretty sad and weird behaviour for an ASA but what gives...

Thanks for reading, Topic done.