ASA Config "Changed" When Users Log-in to VPN

[Matthew Martin]

Hello All,

ASA: v9.4(1)

ASDM: v7.4(1)

AnyConnect: 4.5.04029

While I am logged into the ASDM, and then a user logs into VPN from their AnyConnect client, I receive a Pop-up message stating: "Changes were made to the running configuration via the CLI or by another ASDM user that are not current visible in ASDM..."

Screenshot of Pop-Up in ASDM:

Is this normal behavior?

I can reproduce the pop-up message if I'm on ASDM on my PC and then on another PC I log into VPN with AnyConnect, and after I am authenticated on the other PC I receive that pop-up message in the ASDM instantly.

Thanks in Advance,

Matt

[Bogdan Nita]

Hi Matt,

No this is not normal, you should get the notifications only when somebody modified the configuration.

It is probably a asdm or java bug, try to upgrade both of them.

HTH

Bogdan

[Rahul Govindan]

Maybe a DACL is getting pushed to the ASA during Anyconnect connection? That might cause a new dynamically named ACL to show up in the config every time.

[Matthew Martin]

Hey Rahul, thanks for the reply.

We have Cisco ISE integrated with the ASA for VPN access. And we are doing CoA for when clients authenticate and become compliant, then they receive a dACL from ISE. So maybe that's why?

Thanks Again,
Matt

[Rahul Govindan · Accepted solution]

Pretty sure that's what is causing this. There is a bug detailing the exact same scenario:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuy48004/?rfs=iqvred

Fixed in ASA 9.6(2) or 9.7(1)

[Matthew Martin]

Hey Rahul, thanks again for the reply, very much appreciated!

Ok, that does sound like its the same problem. Our version is only slightly different, but close enough. ASA v9.4(1) and ASDM v7.4(1).

Thanks Again,
Matt