ASDM not working on ASA-5505

[Screwball011]

Hello,

I just got a refurb'd ASA 5505 and configured it with IOS/ASDM.  Everything seems fine but it won't let me open the ASDM in a webpage.  When trying to connect, I get an error telling me a "Secure Connection Failed".  My other firewalls are OK.  Can anyone tell me how to get the ASDM working on this or should I send it back to Cisco?

ciscoasa# sh run
: Saved
:
ASA Version 8.4(4)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
!
boot system disk0:/disk0/asa844-k8.bin
ftp mode passive
object network obj_any
 subnet 0.0.0.0 0.0.0.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-742.bin
no asdm history enable
arp timeout 14400
!
object network obj_any
 nat (inside,outside) dynamic interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd auto_config outside
!
dhcpd address 192.168.1.5-192.168.1.36 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous prompt 2
Cryptochecksum:13af4c80032ad1b0221fd558aff56c58
: end
ciscoasa#

[Marius Gunnerud]

Are you able to ping 192.168.1.1 from your PC?

does the show log output indicate something that might point to the issue?

  logging buffered informational

  logging enable

(you might want to consider logging debuging just for the troubleshooting stage)

Try adding the following command and try to connect:

ssl encryption 3des-sha aes128-sha aes256-sha des-sha rc4-sha

just keep in mind that as of 9.3 this command is depricated but you are running 8.4 so you're good.

If none of these suggestions help, then the issue could very well be Java related.  Try upgrading / downgrading Java on your PC and then test.

--

Please remember to select a correct answer and rate helpful posts

[Screwball011]

ciscoasa(config)# ssl encryption 3des-sha aes128-sha aes256-sha des-sha rc4-sha
The 3DES/AES algorithms require a VPN-3DES-AES activation key.
ciscoasa(config)#

[Marius Gunnerud · Accepted solution]

You are missing the advanced encryption license.  It is a free download from Cisco.

Go to https://tools.cisco.com/SWIFT/LicensingUI/Quickstart#.

from the dropdown menu to the right of the Get New Licenses field select IPS, Crypto, Other... > Security Products > Cisco ASA 3DES/AES License and click next.  Enter the serial number of your ASA and click next.

Then on  your ASA enter the command activation-key <key>  where <key> is replaced by the actual key you receive from Cisco.

Then enter the command ssl encryption 3des-sha aes128-sha aes256-sha des-sha rc4-sha

--

Please remember to select a correct answer and rate helpful posts

[Screwball011]

Everyone,

I'm sorry I haven't responded lately.  Other things arose at work related to more Cisco issues! lol...I will try this and let you guys know.  I appreciate your assistance and guidance.

Thanks,

Scott

[Screwball011]

That worked!

 I obtained the lic key, rebooted and entered the SSL encryption command  ssl encryption 3des-sha aes128-sha aes256-sha des-sha rc4-sha, and the ASDM web interface came online!

Thanks for everyone's assistance.

Scott

[joseoroz]

Hello Screwball011,

Can you provide the output from the command show version and show run all | i ssl.

The configuration looks fine. The only thing that may be missing is the 3des-sha encryption required to access the ASDM.

Regards,

Jose Orozco.

[Screwball011]

ciscoasa# show run all | i ssl
ssl server-version any
ssl client-version any
ssl encryption des-sha1
 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-clientless
  anyconnect ssl dtls enable
  anyconnect ssl keepalive 20
  anyconnect ssl rekey time none
  anyconnect ssl rekey method none
  anyconnect ssl compression none
  anyconnect ssl df-bit-ignore disable
 no pre-fill-username ssl-client
 no secondary-pre-fill-username ssl-client
 no pre-fill-username ssl-client
 no secondary-pre-fill-username ssl-client
compression anyconnect-ssl http-comp
ciscoasa#

[Screwball011]

ciscoasa(config)# ssl encryption 3des-sha aes128-sha aes256-sha des-sha rc4-sha
The 3DES/AES algorithms require a VPN-3DES-AES activation key.
ciscoasa(config)#

[joseoroz]

Hello Screwball011,

Currently you only have des-sha1 enabled. You can run this command to enable the necessary encryption. :

ssl encryption 3des-sha des-sha1

In order to enable this encryption a license is necessary. That license is free. If you need to install it here are the instructions to get it:

https://supportforums.cisco.com/document/67701/asa-versions-image-names-and-licensing#Free_3DESAES_license

Regards,

Jose Orozco.