Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

Installing ASA5505 on my home network

Hi, Just purchased a ASA5505 for my CCNA Security


I want to use one of the interface (the outside interface VLAN2 port eth0/0) to connect to my home network to be able to mange it and use ADSM form my PC. This eth0/0 is set for DHCP on the ASA and I optain IP 192.168.30.151  from my Cisco e4200 home router. Now, I can not https to acess it. I can only access it thru VLAN1 (the inside VLAN) thru a closed network.

How can I connect the VLAN2 port 0 interface to my network ? I can ping it, but can not  https into it. Do I need to setup DMZ or Application/gamig port ?

Thank you.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Super Bronze

Installing ASA5505 on my home network

Hi,

You probably have allowed access to the ASA through the "outside" interface

You might need the following configuration command

http 192.168.30.0 255.255.255.0 outside

Provided that is your network on the "outside"

Easy way to confirm this would be to see the configuration. But since you can access ASDM from the other interface of the ASA then I would presume the problem is missing the above command.

- Jouni

Hall of Fame Super Silver

Re: Installing ASA5505 on my home network

Did you try adding the "ssl encryption des-sha1 aes256-sha1"?

Does anything happen on the ASA's ASDM log as you try to connect?

22 REPLIES
Super Bronze

Installing ASA5505 on my home network

Hi,

You probably have allowed access to the ASA through the "outside" interface

You might need the following configuration command

http 192.168.30.0 255.255.255.0 outside

Provided that is your network on the "outside"

Easy way to confirm this would be to see the configuration. But since you can access ASDM from the other interface of the ASA then I would presume the problem is missing the above command.

- Jouni

New Member

Installing ASA5505 on my home network

Thank you

I changed it from inside to outside, I still do not have access

My IP for VLAN2 is 192.168.0.163 255.255.255.0  (static)

I have :

http server enable

http 192.168.0.0 255.255.255.0 outside

When I ping 192.168.0.163 from my pc on 192.168.0.139 it pings OK

but when I  https://192.168.0.163 to access the server page, it fails....

Installing ASA5505 on my home network

hi,

from which side is your PC connected, behind the 5505 or e4200?

could you kindly post show run?

Hall of Fame Super Silver

Installing ASA5505 on my home network

Can you confirm that ASDM is working on VLAN 1? You aid you can access the ASA but didn't say with what method.

Have you confirmed that the address responding to 192.168.0.163 is the ASA? (Compare ASA's "show interface" command output with "arp -a" on your PC.)

When you browse to the ASA via VLAN 2 and get a failure, what kind of failure is it? Just a blank page?

New Member

Installing ASA5505 on my home network

ASDM working from VLAN1. But I need if on VLAN2 as this is my outside interface towards Internet/home network.

The VLAN2 ip is 192.168.0.163 255.255.255.0

I can ping 192.168.0.163 from my PC at 192.168.0.139

When I hit the enter key after https://192.168.0.163, it goes directly to dead page.

Hall of Fame Super Silver

Installing ASA5505 on my home network

I asked about verifying the MAC address in the event of an address conflict. It's a shot in the dark but something else could be responding to the pings.

When you try to access via VLAN 2 does the ASA report anything in its ASDM log (assuming you have informational or higher ASDM logging turned on)?

New Member

Installing ASA5505 on my home network

It is on the e4200 side, (the home network) but I disconnected it  and connected the PC directly on the ASA with a cross-over cable for now.

When I ping 192.168.0.163 from my pc on 192.168.0.139 it pings OK

but when I  https://192.168.0.163 to access the server page, it fails....

New Member

Installing ASA5505 on my home network

asa5505# sh run
: Saved
:
ASA Version 9.1(2)
!
hostname asa5505
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.0.163 255.255.255.0
!
ftp mode passive
object network obj_any
subnet 0.0.0.0 0.0.0.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network obj_any
nat (inside,outside) dynamic interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.0.0 255.255.255.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd auto_config outside
!
dhcpd address 192.168.1.5-192.168.1.36 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:83d3c0a5f53855a92505b175db342b11
: end
asa5505#

Hall of Fame Super Silver

Installing ASA5505 on my home network

I don't see the expected "ssl encryption des-sha1 aes256-sha1" entry in your configuration.

New Member

Re: Installing ASA5505 on my home network

This is a new Asa.
All i have done is config factory default

I just want to connect it to my home network to start my CCNA security...


Sent from Cisco Technical Support iPad App

Hall of Fame Super Silver

Installing ASA5505 on my home network

I suggested it because lack of that line is a known problem with new ASAs.

https://supportforums.cisco.com/thread/2206779

Installing ASA5505 on my home network

hi,

you've mentioned a different subnet/IP on your original post (192.168.30.151).

make sure both ASA and E4200 have static routes pointed at each other's subnet and enable each for ASDM.

below config on the ASA would cover the 192.168.x.x/16 subnet.

http 192.168.0.0 255.255.0.0 outside

New Member

Re: Installing ASA5505 on my home network

.30 was a typo. Sorry.

Sent from Cisco Technical Support iPad App

Re: Installing ASA5505 on my home network

ok, maybe you don't need static routes here.

did you reserve the ASA's IP192.168.0.163 on the E4200? on your orig post you've set E0/0 to get an IP via DHCP.

make sure it's not handed out to another host/PC.

also, your ASA has dhcpd address 192.168.1.5-192.168.1.36 inside.

i also have a E4200 at home and by default it uses the 192.168.1.0/24 subnet.

try removing this and make the E4200 act as the DHCP server.

New Member

Re: Installing ASA5505 on my home network

I have removed the e4200 and connected a cable between the the pc and the asa.
I can ping .163 but can not https into it.

Sent from Cisco Technical Support iPad App

Hall of Fame Super Silver

Re: Installing ASA5505 on my home network

Did you try adding the "ssl encryption des-sha1 aes256-sha1"?

Does anything happen on the ASA's ASDM log as you try to connect?

Re: Installing ASA5505 on my home network

kindly post dir and show asdm image output.

also, put the command that marvin suggested earlier and try again ssl encryption des-sha1 aes256-sha1

New Member

Re: Installing ASA5505 on my home network

Thanks, I will try the command Marvin posted.
I have upgraded the Asa to 9.1, I will post flash disk0:/

Sent from Cisco Technical Support iPad App

New Member

Installing ASA5505 on my home network

it works fine from the inside interfaces, (eth 1-7) but not from the outside interface (0)

Even after I entered

http 192.168.0.0.255.255.255.0 outside

I tried the command from Marvin, but since it worlk on the inside interfces, that cant be it.

Maybe I will just go back to the 8.2.1 version, might a be a but after i ungraded to 9.1 Thanks !

asa5505# config t
asa5505(config)# ssl encryption des-sha1 aes256-sha1
The 3DES/AES algorithms require a Encryption-3DES-AES activation key.
asa5505(config)#
asa5505(config)#
asa5505(config)# sh flash
--#--  --length--  -----date/time------  path
   10  4096        Jan 01 2008 00:00:22  log
   16  4096        Jan 01 2008 00:00:28  crypto_archive
   17  4096        Aug 28 2008 00:23:10  coredumpinfo
   18  59          Jan 01 2008 00:01:44  coredumpinfo/coredump.cfg
   92  27482112    Aug 28 2008 02:04:08  asa912-k8.bin
   93  18097844    Aug 28 2008 02:04:50  asdm-713.bin
   94  2418        Jan 01 2008 00:01:24  8_2_1_0_startup_cfg.sav
   95  1189        Jan 01 2008 00:01:44  upgrade_startup_errors_200801010001.log


127111168 bytes total (81002496 bytes free)
asa5505(config)

New Member

Re: Installing ASA5505 on my home network

Spent all afternoon on this, but I fixed it.

The fact that I was not able to https into it, was because of the activation keys, - I had none !

Even I got this ASA on ebay, it came with no ASA 3DES License Key. I went on the Cisco site and got one for free.

I even ended up with a full  Security Plus license !!! fully loaded.

It was working on EI 8 on a old laptop, but EI 10 on my PC is more secure and did not allow the page to load, and it did not show the 3DES message. I saw it when I used firefox !

Firefox reported the 3DES missing, so this is how I found the problem. google it and found it.

So, JouniForss was right, all I needed to do is http 192.168.0.0 255.255.255.0 outside to enable VLAN2 on my home network.

Thanks to all.

Hall of Fame Super Silver

Re: Installing ASA5505 on my home network

You're welcome.

The root cause was highlighted when you went to ensure the strong encryption was active for ssl - "The 3DES/AES algorithms require a Encryption-3DES-AES activation key."

Now on to your studies.

Please remember to rate helpful posts and mark your question as answered.

New Member

Re: Installing ASA5505 on my home network

Thanks again Marvin, you were right, I did not make the connection with your solution before I saw the message on firefox browser. I googled the error and ended up on a post where another security noob had the same problem.

I have a CCNA R &S and CCNA Voice, all on  my own, I am now going for a CCNA Security. Just for fun, as Cisco certs are awesome!!

1036
Views
0
Helpful
22
Replies
CreatePlease to create content