Not able to create more than 2 interfaces on Cisco ASA 5506 devices

[pulkit.garg]

HI team,

Our company has just Cisco ASA 5506 devices for office setup. During the configuration we are not able to create more than 2 interfaces and it's giving below error: ( with current license device will only support 2 fully functional interfaces. Third interface can be added, but traffic from this interface to another interface need to be blocked)

We require any additional license or what?

With the product we got one ASA Control License. With this license this issue is resolved or what?

Kindly help, Thanks...

[Bogdan Nita]

Are you running ASDM 7.5.1 ?

Try configuring the interfaces from CLI or update the ASDM.

It seems like you are hitting bug CSCuw09242.

Even the base license does not restrict the number of interfaces. 

ASA Control License is used for the SFR module and allows you to implement application control.

[pulkit.garg]

Hi,

During ASDM update it's asking for Service Contract and we don't have that.

So without service contract we cannot upgrade the ASDM software..

If it's bug then this should be allowed without the service contract as well.

[Seb Rupik]

Hi there,

Cisco will not issue you software without a service contract unless you can show them that the version you are using has some published vulnerability.

What version of ASA-OS are you running. It you are using ASDM 7.5.1 then it must be relatively old, so a good chance you would be affected by this vulnerability:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-asa

Note at the bottom of the page the section Customers Without Service Contracts

Follow those steps. Make you you ask them to also provide a compatible version of ASDM.

cheers,

Seb.

[pulkit.garg]

---

@Seb Rupik wrote:

Hi there,

Cisco will not issue you software without a service contract unless you can show them that the version you are using has some published vulnerability.

What version of ASA-OS are you running. It you are using ASDM 7.5.1 then it must be relatively old, so a good chance you would be affected by this vulnerability:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171004-asa

Note at the bottom of the page the section Customers Without Service Contracts

Follow those steps. Make you you ask them to also provide a compatible version of ASDM.

cheers,

Seb.

---

Hi Seb,

Many thanks for your feedback.

We have new Cisco ASA. When this was compiled actually by Cisco, because if this is old version then update should be provided by Cisco for free as they know some bugs are there in old version.

ciscoasa# show version

Cisco Adaptive Security Appliance Software Version 9.5(1)
Device Manager Version 7.5(1)

Compiled on Wed 12-Aug-15 12:18 PDT by builders
System image file is "disk0:/asa951-lfbff-k8.spa"
Config file at boot was "startup-config"

ciscoasa up 1 day 18 hours

Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
Internal ATA Compact Flash, 8192MB
@BIOS Flash unknown @ 0x0, 0KB

Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
                             Number of accelerators: 1

[Seb Rupik]

Hi there,

Are you configuring your ASA with ASDM? What version? You may be encountering this bug:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuw09242

cheers,

Seb.

[pulkit.garg]

Hi,

Thanks for the quick response..

I am configuring ASA  through ASDM (7.5.1), and ASDM version matching with the bug.

Is this issue will be solved in higher ASDM version? Can we upgrade to higher version? If yes then will you please help me with steps to upgrade the ASDM if you know..

[Seb Rupik]

Hi there,

One possible workaround is to upgrade your version of ASDM.

you will need to decide on the version of ASA software you want to upgrade to, this will dictate what version of ASDM you will need to use. Refer to this table:

https://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#pgfId-226294

Then follow this guide for upgrading using ASDM:

https://www.cisco.com/c/en/us/td/docs/security/asa/upgrade/asa-upgrade/asa-appliance-asav.html#id_27300

cheers,

Seb.

[Hamdi Kadri]

Can you please post the output of the "Show Version" command?