ASDM access impossible - EZVPN

Unanswered Question
Apr 8th, 2010
User Badges:


Why does my ASDM access get cut off when i turn on EasyVPN in client mode on the ASA 5505?

I can access with console, but no longer with ASDM.

Have not tested SSH/Telnet, although im guessing that wont work either.

Why does it get cut off and what can i do to get around this?



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Jennifer Halim Thu, 04/08/2010 - 03:44
User Badges:
  • Cisco Employee,

1) Which interface do you ASDM to?

2) Where are you ASDM from?

StanDamen Thu, 04/08/2010 - 03:46
User Badges:

The inside interface. Only inside and outside interface are configured.

I used ASDM from a computer in the network connected to the inside interface.

This is also the network shared by NEM/ guessing that could be the problem?

If i use a separate interface for management it should work?

Thanks for the help,


Jennifer Halim Thu, 04/08/2010 - 04:01
User Badges:
  • Cisco Employee,

Shouldn't be a problem if you are connecting from the inside, especially if you are running ezvpn in NEM mode.

What version is the ASA 5505?

StanDamen Thu, 04/08/2010 - 04:05
User Badges:

Its version 8.2., the latest I think.

So just to clarify, inside interface is IP with DHCP pool

ASDM is from PC with IP in the DHCP pool



Jennifer Halim Thu, 04/08/2010 - 04:23
User Badges:
  • Cisco Employee,

Sorry, can you please clarify again whether it is client mode or network extension mode?

StanDamen Thu, 04/08/2010 - 04:49
User Badges:

Its network-extension-mode.

Maybe this picture will clear things up again.

The PC using ASDM is in one of the customer LANs. It is connected to the ASA that acts as EasyVPN client with ASDM.

When i enable easyvpn with " vpnclient enable"  on the ASA, the ASDM connection no longer functions.

StanDamen Fri, 04/09/2010 - 04:01
User Badges:

Anyone got any idea?

In the ASDM logging (Through CLI since that keeps working) it says:

ASA-6-106015: Deny TCP (no connection) from to flags FIN ACK  on interface inside is client, is ASA.

Jennifer Halim Fri, 04/09/2010 - 04:57
User Badges:
  • Cisco Employee,

Did you try to log out of ASDM and log back in?

From the error log, it seems to be denying on FIN-ACK packet.

StanDamen Fri, 04/09/2010 - 05:08
User Badges:

Yup tried that, didnt work unfortanetly

What does it mean what it denies the FIN ACK packet?

Thanks for thinking with me though

Jennifer Halim Fri, 04/09/2010 - 04:42
User Badges:
  • Cisco Employee,

With NEM, you can't have the 2 remote LANs in the same subnet ( HQ will not be able to know where to route the packet destined for

StanDamen Fri, 04/09/2010 - 04:46
User Badges:

Yes it is possible by using ACL's linked to the connection profiles.

Also the network at the HQ side are VM's that get there address from a local address pool on the HQ ASA.

Every ACL (and thus every customer) has its own address pool.

I have that all working.

None of this has anything to do with ASDM though, as the ASDM connection shouldn't even pass through the ASA.


This Discussion

Related Content