ASDM Launcher not able to connect on Windows 10

[Luigi Gangitano]

Hi all,

On a new PC with Windows 10 and latest java (1.8.0_77), ASDM 1.7 is unable to connect to any firewall.

Error "java.lang.NoClassDefFoundError: Could not initialize class jdk.nashorn.internal.parser.Lexer" is caused by

  java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\Program Files (x86)\Java\jre1.8.0_77\lib\ext\nashorn.jar" "read")

I've checked file permissions and nothing is wrong. Does anybody else experience the same behavior and has resolved it?

Thanks a lot.

[nwdls8725]

I had that same problem once, and I had to downgrade my java version to 6. 

[Kevin Debelak · Accepted solution]

Do you have a proxy server configured? I experience this when I have a proxy enabled in Internet Settings > Connections tab, but if I disable the proxy it works. 

Even though my proxy is configured to bypass for local IPs, it seems to be some security issue for ASDM application to read the proxy settings?

[Luigi Gangitano]

Thanks for the answer, this seems to be the cause of my problem. Turning off 'Automatic Proxy Configuration' option in Edge enables ASDM Launcher to reach our ASA devices.

Do you know if there is any workaround fixing this problem while keeping the Proxy settings active?

[Kevin Debelak]

I just opened a case with Cisco TAC, seems like it might be a bug in ASDM launcher / not following Java 8 security standards.  I am seeing an error in Java log:

java.lang.ExceptionInInitializerError

Caused by: java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\Program Files (x86)\Java\jre1.8.0_91\lib\ext\nashorn.jar" "read")

I can post back when I get the verdict from Cisco.

The other workaround I found is to to to Configure Java and under Network change it to connect directly. I'm not sure what other security implications this has since you are now bypassing the proxy for all Java programs?

[Luigi Gangitano]

Did you ever get an answer from TAC on this subject?

[Kevin Debelak]

Cisco is telling me that this is a bug in Java. I don't totally agree with them but I don't have the time to spend on this. I just set my Java network settings to connect directly. Not exactly ideal. 

from Cisco TAC:

============
SOLUTION
============
We review the java error that the customer send us. We see that this was a java bug.
Then we sent the workaround so he can open the asdm using java 8 but with direct connection in his computer.

java control panel/ network settings/ check the box --> direct connection and try again to open the ASDM, but we warning that this change it could affect your other applications (that use java) and required to access internet.

[lpsalazar]

thanks Works for me, thanks a lot

[dominac.laymon]

The proxy was the issue. I forgot about a script running on one of my firewalls that pushed out a script that included proxy settings via vpn. I connected to that firewall to test some configuration last week. Today when trying to troubleshoot an issue with another location's firewall, I could not get ASDM to load correctly. Looked up this post and once I removed that, I was able to get in via asdm. Thanks!

[Aditya Ganjoo]

Hi Luigi,

Please share the show version of the ASA.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[Luigi Gangitano]

Here it comes the relevant part:

Cisco Adaptive Security Appliance Software Version 9.3(1)

Device Manager Version 7.5(2)153

[Aditya Ganjoo]

Hi,

Please go to the JAVA console on the Win 10 machine and you can lower the security settings in Java>Security tab on workstation.

Set the security setting to MEDIUM.

Also add the ASDM url in the exception list and then try.

Let me know if it works.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[Luigi Gangitano]

Hi Aditya,

There is no 'Medium' security settings in Java 1.8.0_77 control panel on Windows 10. Lowest setting is 'High'.

Since this is not Java Web Start edition of ASDM but coming from the ASDM-IDM Launcher, adding the ASA IP address to the Exception Site List had no effect on the issue. Still it fails with Security Access denied accessing the local nashorn.jar.

[Aditya Ganjoo]

Hi Luigi,

The last thing you can try is installing the JAVA again and then test.

Make sure Windows have a path to find javaw.exe by putting path in Windows path variable.
Usually javaw.exe would be copied into c:\Windows\System32 or c:\Windows\SysWoW64 or C:\ProgramData\Oracle\Java\javapath. So add one of these path into path system variable to find out javaw executable.

Regards,

Aditya

[Luigi Gangitano]

Thanks for the suggestione. I tried to re-install JRE (both 32-bit and 64-bit version) without luck.

javaw.exe is definitely reachable, ASDM Launcher starts correctly but is not able to connect to firewalls. As soon as I click 'Connect' it start spinning and the Java console shows the AccessControlException I reported in the original message.

It looks like the security profile for the local application (asdm-launcher.jar) does not allow for access to all the relevant libraries, but I don't know how to change it.