New 5505 ASA First INSTALL

[Zebardast2]

I am trying to install a 5505 ASA Firewall on my home network.

Trying to install ISDM Launcher I am having hell with JAVA! I have even a disabled windows software Firewall but it still no good.

I have tried on Win 10Pro, Win7and  Vista, and just can't do it. I think somehow Java keeps getting blocked or something!

Can anyone help please?

[Dinesh Moudgil]

Hi Zebardast2,

Please share the specifications of the workstation alongwith ADSM and Java version.
What is the error that you are getting ?

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.

[Zebardast2]

Thank you Marvin & Dinesh

I shall try to give an idea of what goes on with my effort!

Using Windows 10 Pro (logged in as Admin):

1- I use the“Quick Start Guide” provided with the product.

3- Accordingly I connect to the firewall and using “Microsoft Edge” I log onto

“https://192.168.1.1/admin”.

It then loads the “Cisco ASDM 6.4(5)” page with the following options:
 
a:    “Install Cisco as a local application” [Install ASDN Launcher and Run ASDM]
 
b:     “Run Cisco ASDM as a Java Start application” [Install Java Web Start]

*** Most importantly at the top I have a warning that says: “Certificate error”

4- Then if ignoring the “Certificate error” msg I click and install the Launcher at the next step it asks a  User name and password which I leave blank.
5- Then it warns me that “Windows Smart Screen can't be reached right now” and I chose “Run anyway”and then the app: “dm-launcher (15).msi” loads and prompts me to enter the following:

a- Device IP Address/Name ( I use 192.168.1.1 in this box)
b- Username: (I dont know what to type here and anything I try it fails)
c- Password:  (I dont know what to type here and anything I try it fails)

I guess my main problem here is as Marvin said. Whats the most user friendly way of solving this issue? Have I just paid around $650 on an obsolete device? Should I have paid some more and get something else?

JAVA VERSION:
 
 I have installed BOTH:

     “jre-6u18-windows-i586.exe”and “jre-6u18-windows-x64.exe

Many thanks

[johnlloyd_13]

hi,

could you post the show version output from your 5505?

also make sure you got the 3DES-AES license installed.

Encryption-3DES-AES               : Enabled        perpetual

[Zebardast2]

Hi John and thanks for replying, here it is:

[Marvin Rhoads · Accepted solution]

Make sure you have the 3DES-AES license installed.

show activation-key

...from the cli.

[Zebardast2]

Hi Marvin

Sorry for exposing my inexperience with this but where would I find the License. The store manager where I purchased this  device told me that the10 user license that comes with it is on the CD and when I install the ISDM the license would be automatically loaded!

Best regards

[Marvin Rhoads]

The problem is that most modern browsers (and Java versions that use SSL/TLS under the covers) will not accept the older weak encryption algorithms that the ASA has without first adding the (free) 3DES-AES license.

First we check whether your ASA has that. Login via the command line using either telnet (plug your laptop into the management port and it should get a DHCP address automatically in 192.168.1.0/24 then telnet to the ASA at 192.168.1.1) or console (if you have a console cable and serial port).

Then run the command I asked and share the results.

[Zebardast2]

Thank you Marvin,

This is the result:

ciscoasa# show activation-key
Serial Number:  JMX19404102
Running Activation Key: 0x3c06ce6b 0x001c9be3 0xd803d5cc 0x87b4e880 0x4a3e1998

[Marvin Rhoads]

The whole output is what I was looking for - not just the first two lines.

In any event, based on your reply below, you are getting the ASDM login prompt. That's good.

When the ASA is new out of the box, the username and password can be left blank at this point - just click "OK". That is documented in the quick start guide - see this link for example near the bottom of the guide:

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/5500X/5500x_quick_start.html

(It says 5500-X series but the guidance applies to 5505 as well.)

[Zebardast2]

Hi Marvin,

Sorry for the Misunderstanding. By the way I do understand that when its a new device the username and password is blank but why doesn't allow me then to give it NEW username and pass?

[Marvin Rhoads]

You can create a new username and password in that section of the ASDM configuration menu.

You have to go into a another section to then explicitly tell the ASA to use that local database for authentication for ASDM ("http") and/or the cli ("ssh").

It's a bunch of clicking around to do the latter - I prefer to just use a few cli commands to accomplish it as follows:

aaa authentication ssh console LOCAL 
aaa authentication http console LOCAL 
aaa authorization http console LOCAL

[Zebardast2]

Thank you Marvin,

You'd have to go step by step and be patient with me!

Before I go ahead with:

aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authorization http console LOCAL

Did you get a chance to look at the full output of "show activation-key" I posted? and going by that output would I need to make additional adjustment to address my: “Certificate error”?

Many thanks

[Zebardast2]

Here's the whole output:

[Zebardast2]

Hi Marvin

When I got my ASA5505 device, should an "APK License" have also been included in the package document?

Many Thanks