Cisco ASA-SM: ASDM won't load

So I'm in the process of trying to migrate from the Cisco PIX Series Firewalls to the ASA Series, configured in roughly the same format and style until we can re-migrate to the Zone-Based firewalls. Well, today, I ran into an interesting issue that I couldn't find much support on.

So, these were Cisco ASA-SM (Adaptive Security Appliance Service Modules) loaded into a 6500-E Series. After the device is configured for allowing the appropriate connections, I wanted to load up the ASDM to see the differences in how NAT translations were done (Bi-directional as opposed to Unidirectional).

Except that I couldn't get the ASDM to load. In fact, it wasn't even listening on tcp/443.

As it turns out, for the ASDM to load, you need some additional components. But first, for the uninitiated, how do we set up the ASDM?

You'll find a million posts from Cisco or Blogposts from other users showing you how this is done, so, this should be review. For a brief post on how to configure the ASDM, read here.

Since this is an ASA-SM, out of the box we can session into the blade and configure it from there. You could use telnet or SSH, but since I'm in the process of still building it, I haven't gotten that far yet.

YourRouter#session slot 6 processor 1

Since my routers are in a VSS pair, I use this command:

MyRouter#session switch 2 slot 6 processor 1

This command tells the router that we want to session into the blade, as if we were at the console (session), which switch in the VSS pair I want (switch #, optional due to your configuration), which slot the blade is loaded into (slot #), and which processor I want to use (processor #). 

After you connect to the device, go to the enable mode, and then configure mode.

This, of course, assumes that you have built an interface on the ASA-SM. If you haven't, you'll need to do that first. To configure the device to allow you to connect on http:

yourasa(config)# http server enable

yourasa(config)# http your_subnet_number your_subnet_mask interface

And that's all there is to it! Right?

Except what happens when it doesn't work? Here's where I was, tearing my hair out. 

Cisco has some available documentation on troubleshooting the ASDM:

https://supportforums.cisco.com/document/57701/asdm-access-troubleshooting

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/110282-asdm-tshoot.html

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/116403-configure-asdm-00.html

And others. The first one gave me some good insight and commands, except for one that I couldn't run on the ASA:

show asp table socket

show asp table was present, but the socket option couldn't be found. When I ran an nmap scan against the device, it wasn't even listening on 443. So what gives?

As it turns out, for you to be able to access the ASDM, you have to download and install the free 3DES-AES key from Cisco, which just requires a Cisco user account. You can download it here:

https://tools.cisco.com/SWIFT/LicensingUI/ipsCryptoPage

Under Security Products, you'll find the options for Cisco ASA 3DES/AES License. Once you agree to the terms and conditions, they should send you an e-mail containing the license activation key. 

How can you confirm that you don't already have the 3DES-AES license? Run show version, and look for this:

yourasa# show version

[...]

Licensed features for this platform:

Maximum Interfaces                : 1024           perpetual

Inside Hosts                      : Unlimited      perpetual

Failover                          : Active/Active  perpetual

DES                               : Enabled        perpetual

3DES-AES                          : Disabled       perpetual

Security Contexts                 : 2              perpetual

yourasa#

Once you input the activation key, you should see this:

yourasa# show version

[...]

Licensed features for this platform:

Maximum Interfaces                : 1024           perpetual

Inside Hosts                      : Unlimited      perpetual

Failover                          : Active/Active  perpetual

DES                               : Enabled        perpetual

3DES-AES                          : Enabled        perpetual

Security Contexts                 : 2              perpetual

GTP/GPRS                          : Disabled       perpetual

Botnet Traffic Filter             : Disabled       perpetual

We had to do an additional command to confirm that it would use the 3DES-AES in the SSL configurations:

yourasa(config)# ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1

Once that command was placed in, the web page loaded right away, and allowed us to connect to the ASDM. 

So there you go, hopefully that helps you in your own configurations and troubleshooting for the ASDM and your ASA-SM. 

Writing More!

So I've finally been given the opportunity to write more.

Well, not quite.

I've finally given myself enough reason and motivation to write more.

That's better. 

So, this is my continued attempt at a technical blog. Here, I write down things that I know, learn, and experience for the general-knowledge and well-being that I share with others. As I experience problems, I want to write them down.

So, what am I talking about today?

A colleague of mine and I were talking the other day, and he mentioned to me Windows Azure. So, let's back up a moment before we dive in.

The company that I own (Shameless link) has an Ubuntu 12.04 Linux box hosted by Rackspace so that we can do development. It hosted Web Services (Apache), E-mail Services (Postfix, Courier, SASL Authentication/Encryption, SpamAssassin), Database Services (MySQL, PostgreSQL), and a Mumble server. And all-in-all, it worked fine. We had a Team Foundation Server rented by another company, and added bandwidth, the two services was about $32 a month. We weren't using the TFS service as much as I wanted, so I had looked at killing it, but it wasn't until recently that Visual Studios had integration with Git that I felt that we could change hosting.

Back to the present day.

A colleague of mine and I were talking the other day, and he mentioned to me Windows Azure. In our conversations, he explained what he used it for, how much database and web page space he uses, and basically mentioned that it was for pennies on the dollar. So, in conversation, I learn that he obtained Microsoft Windows services for pennies on the dollar every month. So, I try to be a reasonable business man, let's take a look into it.

Boy, was I impressed. And it's even better than that.

The general notion behind 'cloud' services is that you can host web sites, databases, virtual machines, and more, in a virtual environment. But Microsoft, being the large proprietor of software that they are, made available their resources.

If you sign up for Windows Azure, what can you get?

Free: 

• 10 Web Sites per region. 
• 10 Mobile Services with a 20MB SQL Database with up to 500k API calls.
• An implementation of Active Directory* for up to 500k objects. 
• 100k Notification pushes to active devices 

*It's not a full Active Directory environment as you would see in a normal infrastructure, it's more of a user database, but you can't bind hosts to it. 

So wow, for free, that's pretty impressive, especially for developers. I'm trying to cut costs, and they can run virtual machines, let's see what I can get for $32 a month with respect to my environment:

• I could get two 'Extra Small' Windows VMs, with 1Ghz CPU and 768MB of RAM for $26.79
• Two 'Extra Small' Linux VMs, with the same specifications for the same price.

Pricing calculator here

So, for the cost I'm already incurring, I could build two boxes at the same cost, regardless of Operating System, and have it hosted. At this point, I was feeling pretty confident in this move, because we get the free resources on top of the purchased resources. 

So I talked to my business partner, because when you're co-owned you don't make decisions like this by yourself, and he agreed once I laid out the details for him.

So, we signed up, and started spawning new virtual machines; they were ready in minutes. They had a public IP address, a public DNS name, a public firewall with port translations available, and the resources I had above.

Boy, was I impressed. Don't get me wrong, there's nothing wrong with Rackspace. In face, their management of DNS made it quite easy to get services going, and in general I had no problems with them. This was just better.

So where does it get even better than that?

Last year, the company applied to become a Microsoft BizSpark partner for software development. We have a few major applications that we want to write and sell, and it was difficult to do so because to create them, we needed licenses of things. And after explaining what we wanted to do, we were approved and joined the BizSpark community.

At first, BizSpark was great for us for licenses--Visual Studios, versions of Microsoft Windows for us to test our software on, and copies of different applications offered by Microsoft, which included but not limited to, Microsoft Exchange, SQL Server, Team Foundation Server, BizTalk Servers, and so much more. I estimated it was well over $500,000 in software licensing.

But we had no hosts to run these things on.

Now we do.

Because being a BizSpark partner, and joining Microsoft Azure, they give us $150 in credits a month.

A virtual machine was ~$13.

I can now cut my hosting costs down, spin up new virtual machines, and get all of my hosted needs met so that we can actually code...without having to worry about counting pennies on things. When you have a finite budget...that matters.

This is where it was even better than that.

Because now I can spin up several extra-small virtual servers, host an internal Active Directory, IIS deployment, Exchange, and TFS...without being charged.

We can finally code the way we want to, without having to worry about the costs of doing so. This is exactly what BizSpark was designed to do, and because of Windows Azure we can do it.

This is where it was even better than that. 

So my next few blog posts will be covering the state of things as I install and configure Windows Server 2012, and the related content from there.

Damn, I'm more excited by this than I should be.

New Life

So I've decided to give this blog a new breath of life. Since then, I've changed positions and gained numerous experiences along the way, of which I plan to write about. Any content, documentation, images, or advice is freely posted, I'd just appreciate some credit if you used my solution, or if something you found was different in your configurations.

Disabling IPv6, Part Deux

It should also be noted that apparently disabling IPv6 disconnects all of my SMB connections. Doing that change probably isn't the best of ideas, even though Microsoft didn't mention that part. I'm sure it's not their fault though.

IPv6

I'd like to take this opportunity to thank Microsoft.

Thank you.

Now, for my reason: In Windows Server 2008, you cannot uninstall IPv6.

You can only disable it.

In the registry.

Good ole Windows. Here's the thing:

So I've been getting a massive amounts of failed security audits, event IDs 5157 and 5152. They happen in bursts. They're triggered by svchost, and they're destined for the bit bucket. The source IP address comes from 224.0.0.252 (multiclass) to 169.254.203.141 (private, used by Microsoft for null addresses). The cause of this is what is known as "Link-local Multicast Name Resolution," an IPv6 protocol that performs similar functions to DNS. Wikipedia places it best: "[a] packet format that allows both IPv4 and IPv6 hosts to perform name resolution for hosts on the same local link" (Source: http://en.wikipedia.org/wiki/Link-local_Multicast_Name_Resolution)

And performing a little research, I've learned that you cannot, in fact, uninstall IPv6 much as you can in XP & 2003, but instead, disable. And the only way to disable IPv6 traffic on Server 2008 is through Registry hacking. Here's the blurb from Technet: (bold emphasis my own)

Unlike Windows XP and Windows Server 2003, IPv6 in Windows Vista and Windows Server 2008 cannot be uninstalled. However, you can disable IPv6 in Windows Vista and Windows Server 2008 by doing one of the following:

•	In the Network Connections folder, obtain properties on all of your connections and adapters and clear the check box next to the Internet Protocol version 6 (TCP/IPv6) component in the list under This connection uses the following items. This method disables IPv6 on your LAN interfaces and connections, but does not disable IPv6 on tunnel interfaces or the IPv6 loopback interface.
•	Add the following registry value (DWORD type) set to 0xFF: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents This method disables IPv6 on all your LAN interfaces, connections, and tunnel interfaces but does not disable the IPv6 loopback interface. You must restart the computer for this registry value to take effect.

For additional information about the DisabledComponents registry value, see Configuring IPv6 with Windows Vista.

If you disable IPv6, you will not be able to use Windows Meeting Space or any application that relies on the Windows Peer-to-Peer Networking platform or the Teredo transition technology.

Thanks Microsoft. I appreciate it.

Debian Experience

I'm now involved in a very interesting situation here in my home. My brother and I are going to redesign our network, and have a joint operation domain. So, for the time being, my domain controller plans are on hold until those commence. However, the reason for this came about when a friend of mine asked me to host a game server for his game. He asked me to do this for a variety of reasons:

1) I have the(sic:his) hardware.
2) I have the time.
3) I'd like the experience.

So, using his hardware, we're going to build a Debian Linux box. I've never used Debian before. This is going to be fun.

My configuration:
Abit IC7 motherboard, 2 gigs of PC2700 DDR, and 2x80gb SATA drives to be configured in RAID1 format.

I've spent a good portion of the day installing Debian, trying out some things, screwing up the file system or the partitions, when I finally came across this:

http://nepotismia.com/debian/raidinstall/

This is a very handy guide for creating a software RAID1 on the drives. It varied a bit from my configuration, but, it's not hard to modify. If anyone's ever looking to do what I've done, this is very handy.

I e-mailed Paul and thanked him.

Server 2008 Firewall

Interesting problem discovered today.

Windows Server 2003 used the Firewall Service as a layer of software all network traffic used to pass through it. When you disabled the service, you disabled the firewall.

However, Server 2008 does this differently. The Firewall service is no longer an abstraction layer, but more similar to IPTables in Linux. The firewall service actually controls the settings of the firewall, it does not control the firewall itself. So, if you want the firewall turned off, you actually have to tell the firewall to turn off. Nice feature.