Update ASDM on ASA 5540 via console port CLI

[Eric R. Jones]

Hello, I recently got to ASA 5540's to configure. I managed to upgrade one to match the other in terms of image and asdm.

They are both asa723-k8.bin and asdm-523.bin the issue I have now is that one 5540 has the proper file but will not allow me to set it.

Using "asdm image disk0:/asdm-523.bin" to set the ASDM default file results in the file appearing when you run "sho run"; However, after exiting "config t" mode, running "wri memory" and then "reload" the system comes up but no reference to the asdm-523.bin file is made so I can't run ASDM.

I can remove the file but I can't find a way to upload the same or updated asdm file to the device.

They are not on the network just sitting on my desk and I'm accessing them through the default console port with tera term.

I also access them through the mgt 0/0 port.

I thought about connecting them to a switch and configure one of the ports on the device with an IP and see if I could do that way but I haven't done it yet.

Unfortunately the ASA device doesn't have a "copy xmodem" function like the 3750 switches.

Thanks for any advice on resolving this issue.

ej

[Antonio Knox]

I thought about connecting them to a switch and configure one of the ports on the device with an IP and see if I could do that way but I haven't done it yet.

Eric,

You're on the right track, just trust yourself.  This is absolutely the correct next step.

[Eric R. Jones]

Thanks for the confirmation.

I haven't configured the switch yet but I did manage to fix the problem after a fashion.

What I did was set the pointer properly asdm image disk0:/asdm-525.bin and then set configure facotry-default and finally wri memory.

This allowed me to bring the ASDM up but still hasn't resolved the issue of the disappearing pointer.

If the switch gets reloaded the pointer disappeares and ASDM won't work.

I still have console connectivity just no GUI.

I'm an old UNIX hand so CLI doesn't bother me I just want it to work properly.

So far I have been wrestling with getting the configuration to work through a switch so I can simulate an active WEBVPN connection.

ej

[Antonio Knox]

--

Message was edited by: Antonio Knox

[Antonio Knox]

I know this may be a silly question, but we have to start from the basics.  Have you entered the following in your configuration?

ASA(config)#http server enable

Sorry, but I have to ask.  It's usually the small things......

[Eric R. Jones]

hehehehehe, yeap that was part of the process once I saw that the asdm wasn't staying put.

asdm image disk0:/asdm-641.bin

sho run and check for pointer

http server enable

sho run and check for setting

open browser and access https://192.168.1.1/admin (or appropriate address if changed)

In most cases just watching the icon for the connection at 100mb will be enough to know the server is running.

I have a scheduled call with a CISCO tech today, this and another problem are plauging me.

I can't seem to get the running / startup config to stick after a reload or power cycle.

ej

[Antonio Knox · Accepted solution]

Make sure you post the solution once this is resolved.  Someone else may run into this issue in the future.

[Eric R. Jones]

Well I finally got these devices configured and connected just waiting for a test date.

The issue with one of the devices had to do with an incorrect setting of the configuration register "confreg" after doing a password recovery.

Once that was set to the proper default value "0x1" it was configurable.

I still had some issues with the ASDM GUI tool but was resolved by

1. Updating the ASA image "boot system disk0:/asa###-k8.bin

2. Completing a "wri mem"

3. Updateing the ASDM image "asdm image disk0:/asdm###.bin

4. Completing a "wri mem"

5. Exiting from config t back to the "#" prompt

6. Executing "copy running-config startup-config

7. Executing "reload"

This brought me up to the proper image and GUI software and made sure it was part of the running and startup configs.

I had some issues with just doing a "wri mem" and reloading and finding out that the ASDM was not there and the http server was not running.

After this I had save my previous configuration so it was just a matter of entering "config t" and after modifying the IP addresses doing a cut and paste from the wordpad file into the device. Please make sure that if you do this that our username's, passwords, management IP addresses are all the way you want them so you don't get any errors.

I find the GUI tool to be ok but not very trustable. I had episodes where I configured something, wanted to chane it and the GUI said it was changed but it wasn't reflected at in "sho run".

Also if you save some changes with GUI it will continue to run the "updating device" popup or get stuck at 11% complete.

When you check the CLI you can see the change took effect but the GUI got hungup.

I highly recommend using the CLI for changes and the GUI for data gathering, uploading new images and the like.

The GUI has lots of good features from ASDM631 so if your security policy allows it go ahead and install it.

You can always disable the server "no http server enable" or "no asdm image disk0:/asdm###.bin" until you need it and then just turn it on or reload it.

Also make sure it has 2GB of memory or you won't be able to take advantage of the ASDM images above ASDM631.

My current delima is getting this on the management network. I can't connect it to the console server securelinx SLC8 via the console port. I have started looking for information on how to do this but the console port doesn't work with it.

Each time I connect the management port to the switch I can ping the address from the core switch but I can't from the directly connected 3750.

I checked for IP conflicts but there are none, the port is up and passing traffic so I'm not sure what's going on.

One of the nice things I found out is that to update the image and the GUI you don't really have to go version to version.

You can jump from asa712 to asa831 and you just have to remember to update the ASDM to the latest.

The instructions I read stated you have to update in sequence but that apparently only applies if you use the ASDM tool because  certain versions will only work with a particular asa version.

Some links I used.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008067e9f9.shtml

http://www.cisco.com/en/US/docs/security/asa/quick_start/5500/before.html