Cannot access https/ASDM via firepower asa 2120 inside interface

[hinhnm]

Dear Team,

I have new cisco firepower 2120 asa and i can acess https and asdm via default management port and IP address(192.168.45.1)

I have set inside interface address with address 10.x.x.x and allow https/asdm but cannot access via this interface, could you please hep me to solve this issue?

Thank you very much.

[Rob Ingram]

Hi,
You don't appear to have defined a username defined therefore you'd not be able to login to the ASA. Configure username e.g:- "username admin password YourPassword privilege 15"

HTH

[hinhnm]

Dear RJI, even I have set username and password, I still cannot access ASDM/HTTPS(ping to inside interface is ok)

if I connect via Mgmt interface address, i can access via https/adsm without username and password.

thank you very much

[Rob Ingram]

Ok.

If you look at the error in the browser it indicates "Cannot communicate securely with peer: no common algorithms" - have a look at this to resolve. I am not sure why you can connect with the mgmt interface though.

[hinhnm]

Dear RJI,

yes, i have tried to add asa inside address to allow list in firefox, IE, and chrome and configure tls as your guide but problem still same.

i also tried to configure ssl vpn and when i access to outside interface --> the problem seem that same as inside interface, please see my attached image. do i need to configure ssl/certificate on my ASA?

thank you very much

[Rob Ingram]

Hi, Please provide the full configuration of the ASA

[hinhnm]

Dear RJI,

please see the file, thank you.

[hinhnm]

I have found this topic but not sure it will solve my issue or not.

i'm waiting local vendor to support get license because Cisco website inform that my device SN was not existing.

https://community.cisco.com/t5/network-security/dont-enable-asdm/td-p/3031164

[hinhnm]

My problem has solved after enable 3DES license. Thank you all for your support.

[Marvin Rhoads]

@hinhnm you have:

http 192.168.1.0 255.255.255.0 inside

...but all your inside routes are for 10.164.x.x. subnets. Thus the ASA won't use the proper interface to return incoming traffic from 192.169.1.0/24 that arrives on the inside interface.