ASDM 6.4 ; ASA 5510 version 8.4(1) - Can not access ASDM

[Hiral Tewar]

Hello Experts,

I want to access ASDM from my management PC. I can ping from MANAGEMENT PC as well as do SSH login however i can not access ASDM via browser.

Please guide me.

Followings are usful details:

Running Configuration

ciscoasa# show run

: Saved

:

ASA Version 8.4(1)

!

hostname ciscoasa

enable password 9jNfZuG3TC5tCVH0 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

 nameif INSIDE

 security-level 90

 ip address 192.168.1.1 255.255.255.0

!

interface Ethernet0/1

 shutdown

 no nameif

 no security-level

 no ip address

!

interface Ethernet0/2

 shutdown

 no nameif

 no security-level

 no ip address

!

interface Ethernet0/3

 shutdown

 no nameif

 no security-level

 no ip address

!

interface Management0/0

 shutdown

 no nameif

 no security-level

 no ip address

!

ftp mode passive

pager lines 24

mtu INSIDE 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-641.bin

no asdm history enable

arp timeout 14400

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.5 255.255.255.255 INSIDE

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 INSIDE

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

username admin password e1z89R3cZe9Kt6Ib encrypted privilege 15

!

class-map inspection_default

 match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

call-home

 profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:afe73d128f7510e1bf9463fd698fa7fb

: end

Successful PING Bothways

ciscoasa(config)# ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

ciscoasa(config)# ping 192.168.1.5

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

ciscoasa(config)# exit

Thank you :-)

[Marvin Rhoads · Accepted solution]

Please share the output of:

show ver | i 3DES

show ssl

The key bits of that output would be ensuring your 3DES-AES license is active and that your ASA is supporting strong cryptographic algorithms (ciphers).

[Hiral Tewar]

Hello Marvin,

Thank you for your reply and pointnig in right direction. 

You are right, when i check out put with your suggested command, i realise that my ASA is not supporting 3des or AES such that i have requested new licence from cisco. After validating new activation-key, i can access asdm. I also took help from following link. 

https://supportforums.cisco.com/document/49741/asa-pixfwsm-unable-manage-unit-sshtelnetasdm

However this has lead to new problem. when i type in https://192.168.1.1 - it gives me certificate warning to which i continue, Then it ask me to install and run asdm, which i did, after that i launched ASDM which ask for device IP, username and password, I key in correct information but since then it dose not come up with ASDM screen. 

Would you be kind enough to point me in right direction, again, plzz ?

Regards

[Marvin Rhoads · Accepted solution]

You're welcome - good to know you are closer. Please rate the earlier reply as correct. :)

For your next issue, I suspect you are having a Java issue. If you are running Java 7 Update 51 or higher, it has problems with ASDM. Please see this thread for the resolution steps

[Hiral Tewar]

Hello Marvin,

Thank you once again for pointing me in right direction. Experts like you make our experience, knowledge and industry rich place. I can now work on ASDM :-)

Many Thanks,

[msalmon]

I had a problem using windows 8.1 64 bit pc with accessing a ASA 5520 running 8.4 and ASDM 6.4. The only browser that worked (i saw the run ASDM button) was the latest version of Mozila. I also had to allow the remote ASA in the exclude list for Java version 7. It took a lot to get to where I am. I still cannot run ASDM software only the Java applet.

[Marvin Rhoads]

Are you able to go to cisco.com and download the ASDM installer for Windows (msi file) directly?

Go here and look for asdm-demo-716.msi. That's (currently) the latest version of the standalone installer for Windows. With it, you can specify any accessible ASA to manage, even if it has an earlier version locally.