ASA-5510: Unable to get to the Web Deploy page for the AnyConnect download

TJ-20933766 · ‎02-23-2020

Hardware: ASA 5510

Version: 9.1(7)25

AnyConnect File: anyconnect-win-4.7.01076-webdeploy-k9.pkg

I've read many posts and watched multiple videos but for some reason I cannot get the web deploy page to show up that allows a user to authenticate and then download the AnyConnect client. I can get the ASDM page to come up just fine but not the webvpn page.

I've tried a different AnyConnect image to see if that was the issue but there was no change. Could anyone point me in the right direction on this one?

ciscoasa(config)# show run
: Saved
:
: Serial Number: **************
: Hardware:   ASA5510-K8, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
:
ASA Version 9.1(7)25
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
ip local pool VPN-POOL 192.168.255.1-192.168.255.15 mask 255.255.255.240
!
interface Ethernet0/0
 nameif OUTSIDE
 security-level 0
 ip address dhcp
!
interface Ethernet0/1
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Ethernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Ethernet0/3
 nameif INSIDE
 security-level 100
 ip address 192.168.0.1 255.255.255.0
!
interface Management0/0
 management-only
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
object network LAN
 subnet 192.168.0.0 255.255.255.0
object network VPN-NET
 subnet 192.168.255.0 255.255.255.240
pager lines 24
mtu OUTSIDE 1500
mtu INSIDE 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (INSIDE,OUTSIDE) source static LAN LAN destination static VPN-NET VPN-NET no-proxy-arp route-lookup
!
object network LAN
 nat (INSIDE,OUTSIDE) dynamic interface
route OUTSIDE 0.0.0.0 0.0.0.0 10.0.0.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 0.0.0.0 0.0.0.0 OUTSIDE
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint Identity_Cert
 enrollment self
 fqdn vpn.cisco.com
 subject-name CN=vpn.cisco.com,OU=IT,O=Cisco,C=US,St=CA,L=San_Jose
 proxy-ldc-issuer
 crl configure
crypto ca trustpool policy
crypto ca certificate chain Identity_Cert
 certificate e030123e
    308203e3 308202cb a0030201 020204e0 30123e30 0d06092a 864886f7 0d010105
    05003081 80311130 0f060355 04070c08 53616e5f 4a6f7365 310b3009 06035504
    08130243 41310b30 09060355 04061302 5553310e 300c0603 55040a13 05436973
    636f310b 30090603 55040b13 02495431 16301406 03550403 130d7670 6e2e6369
    73636f2e 636f6d31 1c301a06 092a8648 86f70d01 0902160d 76706e2e 63697363
    6f2e636f 6d301e17 0d303330 31323731 39353735 395a170d 31333031 32343139
    35373539 5a308180 3111300f 06035504 070c0853 616e5f4a 6f736531 0b300906
    03550408 13024341 310b3009 06035504 06130255 53310e30 0c060355 040a1305
    43697363 6f310b30 09060355 040b1302 49543116 30140603 55040313 0d76706e
    2e636973 636f2e63 6f6d311c 301a0609 2a864886 f70d0109 02160d76 706e2e63
    6973636f 2e636f6d 30820122 300d0609 2a864886 f70d0101 01050003 82010f00
    3082010a 02820101 00b4e3d3 6126b8ce 8b2549cb 1503ffbd 420ad489 3c963aae
    c78be506 f73f3d18 5f21c1b9 536a50ce 7abed237 77cf6324 77b8187c aceb60ce
    e0a9afbe ee0a83fe cf8bfa46 7a844023 868d2ba7 e771cc3a dbec517e 105eaea0
    3d4e5576 08054e00 28061b29 58e0ff7d 64fca281 50628ce3 62198137 58e14111
    9fefaaf7 865ed5b5 0be0855d a5e249bf bd2f05d6 8e6d21a5 b8475ea1 72e54206
    b8013cad 05124056 e8ed7039 ea24988f b7ceea6f 6f07eb6c 9eeec6e4 be6d398c
    6f1e5324 119ae50c b3a35f48 fe873d83 27c0af86 b72d8a37 71854c8a d328faee
    7b382147 c4c7b214 55361bd7 90444e41 37181200 e031b99f 0c7d5e02 a4ef8fca
    4ced4d9b d8015ff9 b5020301 0001a363 3061300f 0603551d 130101ff 04053003
    0101ff30 0e060355 1d0f0101 ff040403 02018630 1f060355 1d230418 30168014
    2a7cf772 ace63805 b1519bd8 7f67199d 001960b0 301d0603 551d0e04 1604142a
    7cf772ac e63805b1 519bd87f 67199d00 1960b030 0d06092a 864886f7 0d010105
    05000382 01010034 244f16bc 89578b80 401a9416 d82703cd 9a89b106 cbdd175d
    b1d9a282 7d06d136 d135c7c5 905fa56e 39e4e513 2edf5f02 a8a8430d 99025a60
    23c83bde d9db97e7 b11054e4 2107b2d8 5fe9dad7 f035400a 2752172a b1a3a5a9
    902dece0 3691762a f34e9e4f 396ce0e9 9da6333b 0c89f67b 399c3aad fd51b921
    95c70336 57887c23 38a5ebe8 50edf71f 54e63a86 df612354 15e8d8ab 92800461
    6e2b44c2 7779f437 e028188e f408c86f 20ae0832 9e581715 1e050ab4 4fd22470
    d5c51c49 42d7d2ac 70be1474 acdafdfd 03de1d86 61ef39c0 4e6c1005 bd7dead8
    bd3c81f9 e6a8598c 0bdf0689 50903928 cdd4d27f 0c2d34b8 349db7a9 e5abc5d2
    6d04b8f4 3b1eb1
  quit
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point Identity_Cert INSIDE
ssl trust-point Identity_Cert OUTSIDE
webvpn
 enable OUTSIDE
 anyconnect image disk0:/anyconnect-win-4.7.01076-webdeploy-k9.pkg 1
 anyconnect enable
 tunnel-group-list enable
 cache
  disable
group-policy GroupPolicy_SSL-VPN internal
group-policy GroupPolicy_SSL-VPN attributes
 wins-server none
 dns-server value 10.0.2.9
 vpn-tunnel-protocol ssl-client ssl-clientless
 default-domain none
username tjoachims password 291k9ma./1014n9aahsli encrypted privilege 15
tunnel-group SSL-VPN type remote-access
tunnel-group SSL-VPN general-attributes
 address-pool VPN-POOL
 default-group-policy GroupPolicy_SSL-VPN
tunnel-group SSL-VPN webvpn-attributes
 group-alias SSL-VPN enable
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:07d594c3ad342559e388b10265928dd5

Rob Ingram · ‎02-24-2020

Hi,
What is the output of "show asp table socket" - does it confirm that the ASA is listening on SSL/DTLS on the outside interface?
If you enable "debug webpn 128" and attempt to connect to the WebVPN page do you see any debug output? (you'll obviously have to enabling monitor/console logging).
Does the ASA receive a public IP address on the outside interface via DHCP?
If you have a modem in front of the ASA you might need to port forward tcp/443 and udp/443.

HTH

Marius Gunnerud · ‎02-24-2020

for starters change your http configuration to use a different port than 443 and then test. Use port 4433 for example. Keep in mind that each time you access the ASA via ASDM you need to specify this port or the connection will fail.

http server enable 4433

--
Please remember to select a correct answer and rate helpful posts