Hi, VLANs do not need to be defined on the ASA, assuming the switch supports inter-vlan routing (which I believe the 2960CG does) you can configure the VLANs on the switch. The IP address assigned to each VLAN would be the default gateway for clients in each VLAN. The link between the switch and the ASA could be a dedicated VLAN on the switch, doesn't need to be trunked. You would require a static route on the switch for the default route (0.0.0.0/0.0.0.0) pointing to the ASA's inside IP address. The ASA would require static routes pointing to the switch for each of the VLAN networks. Or setup a dynamic routing protocol, only OSPF and RIP appear to be supported on that model. HTH ... View more

What about when you append /admin? - https://1.1.1.1/ADMIN ... View more

Can you try again from a different browser? Are you accessing the webpage when connected to the outside of the ASA? ... View more

This is from the cisco website? If you go to the ASA login page, e.g:- https://1.1.1.1/admin you download ASDM from there and then install on the computer. You do this only once, once installed you access ASDM directly. I was querying whether you'd already done this on your computer, in which case ASDM would already have been downloaded and installed. ... View more

Well it proves that you can at least access the login page, which is good! Try appending /admin after the IP address. E.g:- "https://1.1.1.1/admin" - obviously replacing 1.1.1.1 with your IP address   If you already have ASDM installed then you don't need to open a web browser, you can just open ASDM set the IP address as the outside interface IP address and then login. ... View more

Yes it should work on the outside interface. You can also enable it on the management interface, if it was already enabled and you have a management network. I assume you are currently connected to the inside interface? ... View more

Ok, fine...you already enabled in on the outside and management interfaces in the previous screenshot. You should just apply and save the configuration, then test connection to the outside interface IP address - from an IP address that is on the outside of the ASA (in other words don't connect from your inside network). ... View more

You need it enabled on the outside interface if you are connecting from the outside interface, which it sounds like what you intend to do. ... View more

You configure management access in ASDM as per the screenshot in your 1st reply or per my first reply, with the command "http 0.0.0.0 0.0.0.0 outside". This would permit access from any IP address on the internet to access your ASA on it's outside interface's IP address. ... View more

Well your outside interface IP address would be part of that object "outside-network". From ASDM go to Configuration > Device Setup > Interfaces. The public IP address named "outside" would be the IP address you need to use. ... View more

It's got nothing to do with NAT, you need to connect to the IP address assigned to the outside interface. ... View more

Yes you need to use IKEv2 and yes the lifetime is configurable with the command "crypto map MAP 1 set security-association lifetime seconds XXXXX". ... View more

You would have to permit all IP addresses on the outside interface for ASDM/HTTPS - unless you know the source, in which case define those static IP addresses. The IP address to connect to when using the web browser is the IP address of your "outside" interface. HTH ... View more

Hi, I assume you are referring to SHA-256 is not being configurable in IKEv1 Phase 2? In which case you would need to use IKEv2 instead, you would need to ensure the peer firewall is also using IKEv2. HTH ... View more