One of the topics that is tested on the CCNA security exam is the
adaptive security service manager (ASDM) of the Cisco ASA. This article
will walk you through “installing” the ASDM on a Cisco ASA through GNS3.
This will be helpful to those who want to familiarize themselves with
the ASDM interface (the way we have been doing in the
CCP series).
We will need a TFTP server, the ASDM image file, and the ASA we want
to install it on. Our lab setup will contain just one ASA and one host
(my laptop), which will act as both the TFTP server and the computer we
will use to launch the ASDM when finished. The GNS3 topology is shown
below:
Notice that I have used a switch to connect the host and the ASA
because GNS3 does not support connecting a cloud/host directly to an
ASA. The switch is just an “Ethernet switch” and all the ports are in
the same VLAN (although you can change that).
The first thing we want to do is to make sure that the host and the ASA can communicate. We will use the 192.168.10.0/24 subnet.
Notice that, even though in the GNS3 topology the ASA interfaces are
identified with “e” (signifying Ethernet?), they are actually Gigabit
Ethernet interfaces. The ping also reveals that I can communicated with
my host PC (192.168.10.10).
Now that we have communication, the next thing we need to do is load
the ASDM image unto the ASA. There are several options including HTTP,
FTP, and TFTP, but we will stick with TFTP because of its simplicity.
One of the best TFTP servers I have used is 3CDaemon and it can also act
as an FTP or Syslog server. You can download free TFTP servers
including 3CDaemon
here. The 3CDaemon interface is shown below:
Notice that, when it starts up, 3CDaemon listens for requests on all
of your active interfaces so you don’t have to do anything special to
get it to listen for requests. However, we have to configure the
location of our ASDM image by clicking on “Configure TFTP Server.”
Once you are done, you can click on the
Apply button to save the changes you have made. We will now copy the ASDM image to the ASA using the
copy tftp: flash: command.
Note:
copy tftp: disk0: will also work.
Notice that, after issuing the copy command, I can then specify the
options, such as the IP address of the TFTP server and file name. I
could have specified all those options in the copy command, but I prefer
this method because it is easier than having to remember syntax. Also,
keep in mind that, when specifying the file name, you must also specify
the extension, e.g., “.bin” or the TFTP server will not be able to
locate the file you are requesting. While the file is being copied, you
can view the status in 3CDaemon, as shown below:
When this process is finished, the ASA will write the ASDM image and you will be presented with the prompt where you left off.
At this point, even though the ASDM file has been copied to the ASA’s
flash, we still have to specify that it was an ASDM file we copied
(after all, it could have been any other file). We do this using the
asdm image global configuration command. If you don’t know the name of the file, just use the
show flash or
show disk0: command to get the name.
If the command is successful, you can use the
show version command to see the ASDM image installed. The
show asdm image command is also helpful.
Just like Telnet or SSH, we need to specify what hosts can connect to
the ASA through the ASDM. Remember that the ASDM is accessed via a web
interface, i.e., HTTPS, so we must first enable the HTTPS server.
From the above screenshot, you can see that I have enabled the HTTPS
server and configured the ASA to allow the 192.168.10.0/24 subnet on the
inside interface.
I can now open a web browser and navigate to https://
/. In our case, it will be https://192.168.10.1/. You will probably get a certificate error because your computer does not recognize the ASA’s digital certificate.
As you can see, we can either run ASDM as a local application (ASDM
launcher installed on our computer) or as a Java Web Start application.
Let us first attempt to install the ASDM launcher because, once it is
installed, we will not need to connect using a web browser anymore. You
will understand why I said “attempt” as you read on.
When I clicked on the “Install ASDM Launcher” button, I got an authentication dialog box as shown below:
I left the default configuration of my ASA as it was, meaning that I
did not configure username or password. By leaving the username and
password fields empty and clicking on the OK button, the prompt
disappeared and I was able to “Run” the installation file. *shrugs*
When the installation is done, the ASDM launcher opens and you can specify the IP address, username, and password settings.
Now will be a good time to configure the username/password on the
ASA. By default, the ASA will use its local database for authenticating
HTTP connections, so we don’t need to explicitly specify that.
When I click on the “OK” button, I get an error:
Unable to launch device manager from .
I did a search on this error and found that it has to do with my Java
version, which is version 7, update 51. There are a couple of
workarounds for this, including downgrading your Java version (ouch) or
running ASDM via the Java Web Start through the web browser. You can
view
this thread for the complete details on fixing this error. In this article, we will just fall back to the Java Web Start.
Clicking that link will trigger a download that, when opened, will
bring up the ASDM Launcher similar to the one we saw above but without
the device IP address field.
After we specify the correct username and password, the ASDM launcher will get the updated software as shown below:
Once that is complete, we are presented with the ASDM interface for that ASA.
Now you can play around with ASDM!
J Remember to save your configuration.
Summary
In this article, we have seen how to enable the ASDM on an ASA device
running in GNS3. Let us recap the steps again: Make sure the ASA can
access the TFTP server; specify the ASDM image file directory on the
TFTP server; copy the ASDM image from the TFTP server to the ASA using
the
copy tftp: flash: command; enable the ASDM image on the
ASA; enable the HTTP server; configure allowed host(s); configure
username and password; open browser to ASA’s IP address using HTTPS.
This article prepares the way for the ASDM series that will follow. I hope you have found this article helpful.
source: http://resources.intenseschool.com/setting-up-asdm-on-the-cisco-asa-in-gns3/
