Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

UNABLE TO ACCESS PIX515E VIA ASDM

Hi all,

           I have a basic config on the device, the ASDM was working fine untill i modify a NAT rule. Since then I am unable to access the device with asdm 61551, I have tried to upgrade to asdm 603, but get other issue with it as per below

SNAFLAB01(config)# copy  tftp: flash:

Address or name of remote host [192.168.23.27]?

Source filename [asdm-603.bin]?

Destination filename [asdm-603.bin]?

Accessing tftp://192.168.23.27/asdm-603.bin...
WARNING: TFTP download incomplete!

%Error reading tftp://192.168.23.27/asdm-603.bin (Unspecified Error)
SNAFLAB01(config)#

PIX is can ping TFTP SERVER,and TFTP server can ping pix back.

There is the basic PIX config

: Saved
:
PIX Version 8.0(4)
!
hostname SNAFLAB01
enable password F.MMy3dfjSesZjVs encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address dhcp
!
interface Ethernet1
speed 100
duplex full
nameif inside
security-level 100
ip address 192.168.23.2 255.255.255.0
!
interface Ethernet2
nameif DMZ24
security-level 80
ip address 192.168.24.1 255.255.255.0
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet5
shutdown
no nameif
no security-level
no ip address
!
boot system flash:/image.bin
ftp mode passive
same-security-traffic permit intra-interface
access-list inside_access_in extended permit icmp 192.168.23.0 255.255.255.0 192.168.24.0 255.255.255.0
access-list inside_access_in extended permit ip 192.168.23.0 255.255.255.0 192.168.24.0 255.255.255.0
access-list inside_access_in extended permit ip 192.168.23.0 255.255.255.0 any
access-list outside_access_in extended permit ip 172.16.0.0 255.255.0.0 192.168.23.0 255.255.255.0
access-list outside_access_in extended permit icmp 192.168.24.0 255.255.255.0 192.168.24.0 255.255.255.0
access-list DMZ24_access_in extended permit icmp 192.168.24.0 255.255.255.0 192.168.23.0 255.255.255.0
pager lines 24
logging enable
logging buffered debugging
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu DMZ24 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit 172.16.0.0 255.255.0.0 outside
icmp permit any inside
icmp permit 192.168.23.0 255.255.255.0 inside
asdm image flash:/asdm-603.bin
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 101 0.0.0.0 0.0.0.0
static (outside,inside) interface 74.210.56.28 netmask 255.255.255.255
static (DMZ24,inside) 192.168.24.0 192.168.23.0 netmask 255.255.255.0
static (inside,DMZ24) 192.168.23.0 192.168.23.0 netmask 255.255.255.0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group DMZ24_access_in in interface DMZ24
route outside 0.0.0.0 0.0.0.0 74.210.56.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.23.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 192.168.23.5 255.255.255.255 inside
telnet 192.168.23.0 255.255.255.0 inside
telnet timeout 5
ssh 192.168.23.5 255.255.255.255 inside
ssh 192.168.23.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username crazydonjuan password oRCgyJTjAIKhgirc encrypted
!
class-map global-class
match default-inspection-traffic
!
!
policy-map global-policy
class global-class
  inspect ctiqbe
  inspect icmp
  inspect icmp error
!
service-policy global-policy global
prompt hostname context
Cryptochecksum:cd485f4ab354b64952e933755e1b793f
: end
SNAFLAB01(config)#

SNAFLAB01(config)# sh asp table socket


Protocol  Socket    Local Address               Foreign Address         State
SSL       000050dc  192.168.23.2:443            0.0.0.0:*               LISTEN
TCP       0000b694  192.168.23.2:23             0.0.0.0:*               LISTEN
TCP       00015c34  192.168.23.2:22             0.0.0.0:*               LISTEN
SNAFLAB01(config)#

Directory of flash:/

7      -rw-  7495736     00:48:09 Nov 09 2010  image.bin
11     -rw-  7605252     01:07:50 Nov 09 2010  asdm-61551.bin

Thanks,

Jean Paul

1 REPLY
Cisco Employee

Re: UNABLE TO ACCESS PIX515E VIA ASDM

You might want to remove the following static NAT statement as it will cause you a lot of issues:

static (outside,inside) interface 74.210.56.28 netmask 255.255.255.255

Then "clear xlate" after removing the above. You should have access to ASDM again.

This is not a supported configuration NATing the inside interface 1:1 to a public ip address.

437
Views
0
Helpful
1
Replies
CreatePlease login to create content