Use ASDM to Manage a FirePOWER Module on an ASA

Available Languages

Download Options

  • PDF     (847.6 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (910.4 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (914.1 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:July 14, 2023
Document ID:200889

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes how ASDM software communicates with the Adaptive Security Appliance (ASA) and a FirePOWER software module installed on it.

    Background information

    A FirePOWER module that is installed on an ASA can be managed by either:

    • Firepower Management Center (FMC) - This is the off-box management solution.
    • Adaptive Security Device Manager (ASDM) - This is the on-box management solution.

    Prerequisites

    Requirements

    An ASA configuration to enable ASDM management:

    ASA5525(config)# interface GigabitEthernet0/0
ASA5525(config-if)# nameif INSIDE
ASA5525(config-if)# security-level 100
ASA5525(config-if)# ip address 192.168.75.23 255.255.255.0
ASA5525(config-if)# no shutdown
ASA5525(config)#
ASA5525(config)# http server enable
ASA5525(config)# http 192.168.75.0 255.255.255.0 INSIDE
ASA5525(config)# asdm image disk0:/asdm-762150.bin
ASA5525(config)#
ASA5525(config)# aaa authentication http console LOCAL
ASA5525(config)# username cisco password cisco

    Check the compatibility between the ASA/SFR module, otherwise the FirePOWER tabs are not seen.

    Additionally, on the ASA the 3DES/AES license must be enabled:

    ASA5525# show version | in 3DES
Encryption-3DES-AES               : Enabled        perpetual

    Ensure the ASDM client system runs a supported version of Java JRE.

    Components Used

    • A Microsoft Windows 7 host
    • ASA5525-X that runs ASA Version 9.6(2.3)
    • ASDM Version 7.6.2.150
    • FirePOWER software module 6.1.0-330

    The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

    Architecture

    The ASA has three internal interfaces:

    • asa_dataplane - It is used to redirect packets from the ASA Data Path to the FirePOWER software module.
    • asa_mgmt_plane - It is used to allow the FirePOWER management interface to communicate with the network.
    • cplane - Control Plane interface that is used to transfer keepalives between the ASA and the FirePOWER module.

    You can capture traffic in all internal interfaces:

    ASA5525# capture CAP interface ?

  asa_dataplane   Capture packets on dataplane interface
  asa_mgmt_plane  Capture packets on managementplane interface
  cplane          Capture packets on controlplane interface

    This can be visualized as follows:

    Architecture2

    Background Operation When a User Connects to an ASA via ASDM

    Consider this topology:

    Network diagram

    When a user initiates an ASDM connection to the ASA, these events occur:

    Step 1 - The User Initiates the ASDM Connection

    The user specifies the ASA IP address used for HTTP management, enters the credentials, and initiates a connection towards the ASA:

    GUI input

    In the background, an SSL tunnel between the ASDM and the ASA is established:

    GUI input


    This can be visualized as follows:

    Network diagram

    Step 2 - The ASDM Discovers the ASA Configuration and the FirePOWER Module IP Address

    Enter the debug http 255 command on the ASA in order to show all the checks that are done in the background when the ASDM connects to the ASA:

    ASA5525# debug http 255
…
HTTP: processing ASDM request [/admin/exec/show+module] with cookie-based authentication 
HTTP: processing GET URL '/admin/exec/show+module' from host 192.168.75.22
HTTP: processing ASDM request [/admin/exec/show+cluster+interface-mode] with cookie-based authentication 
HTTP: processing GET URL '/admin/exec/show+cluster+interface-mode' from host 192.168.75.22
HTTP: processing ASDM request [/admin/exec/show+cluster+info] with cookie-based authentication 
HTTP: processing GET URL '/admin/exec/show+cluster+info' from host 192.168.75.22
HTTP: processing ASDM request [/admin/exec/show+module+sfr+details] with cookie-based authentication 
HTTP: processing GET URL '/admin/exec/show+module+sfr+details' from host 192.168.75.22
    • show module - The ASDM discovers the ASA modules.
    • show module sfr details - The ASDM discovers the module details, which include the FirePOWER management IP address.

    These are seen in the background as a series of SSL connections from the PC towards the ASA IP address:

    data output

    Step 3 - The ASDM Initiates Communication Towards the FirePOWER Module

    Since the ASDM knows the FirePOWER management IP address, it initiates SSL sessions towards the module:

    GUI input

    This is seen in the background as SSL connections from the ASDM host towards the FirePOWER management IP address:

    GUI input

    This can be visualized as follows:

    Network diagram

    The ASDM authenticates the FirePOWER and a security warning is shown since the FirePOWER Certificate is self-signed:

    GUI input

    Step 4 - The ASDM Retrieves the FirePOWER Menu Items

    After the successful authentication, the ASDM retrieves the Menu Items from the FirePOWER device:

    GUI input

    The retrieved tabs are shown in this example:

    GUI input

    It also retrieves the ASA FirePOWER Configuration Menu Item:

    GUI input

    Troubleshoot

    In case ASDM cannot establish an SSL tunnel with the FirePOWER Management IP address, it only loads this FirePOWER Menu Item:

    GUI input

    The ASA FirePOWER Configuration Item is missing as well:

    GUI input

    Verification 1

    Make sure that the ASA management interface is UP and the switchport connected to it is in the proper VLAN:

    ASA5525# show interface  ip brief | include Interface|Management0/0
Interface                  IP-Address      OK? Method Status                Protocol
Management0/0              unassigned      YES unset  up                    up

    Recommended Troubleshooting

    • Set the proper VLAN.
    • Bring the port UP (check the cable, check the switchport configuration (speed/duplex/shut)).

    Verification 2

    Make sure that the FirePOWER module is fully initialized, UP, and running:

    ASA5525# show module sfr details
Getting details from the Service Module, please wait...

Card Type:          FirePOWER Services Software Module
Model:              ASA5525
Hardware version:   N/A
Serial Number:      FCH1719J54R
Firmware version:   N/A
Software version:   6.1.0-330
MAC Address Range:  6c41.6aa1.2bf2 to 6c41.6aa1.2bf2
App. name:          ASA FirePOWER
App. Status:        Up
App. Status Desc:   Normal Operation
App. version:       6.1.0-330
Data Plane Status:  Up
Console session:    Ready
Status:             Up
DC addr:            No DC Configured
Mgmt IP addr:       192.168.75.123
Mgmt Network mask:  255.255.255.0
Mgmt Gateway:       192.168.75.23
Mgmt web ports:     443
Mgmt TLS enabled:   true

    A5525# session sfr console
Opening console session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
> show version
--------------------[ FP5525-3 ]--------------------
Model                     : ASA5525 (72) Version 6.1.0 (Build 330)
UUID                      : 71fd1be4-7641-11e6-87e4-d6ca846264e3
Rules update version      : 2016-03-28-001-vrt
VDB version               : 270
----------------------------------------------------

>

    Recommended Troubleshooting

    • Check the output of the show module sfr log console command for errors or failures.

    Verification 3

    Check basic connectivity between the ASDM host and the FirePOWER module management IP with commands such as ping and tracert/traceroute:

    CLI output

    Recommended Troubleshooting

    • Check routing along the path.
    • Verify that there are no devices in the path that block the traffic.

    Verification 4

    If the ASDM host and the FirePOWER management IP address are in the same Layer 3 network, check the Address Resolution Protocol (ARP) table on the ASDM host:

    CLI output

    Recommended Troubleshooting

    • If there are no ARP entries, use Wireshark in order to check the ARP communication. Ensure the MAC addresses of the packets are correct.
    • If there are ARP entries, ensure they are correct.

    Verification 5

    Enable capture on the ASDM device while you connect via ASDM in order to see if there is proper TCP communication between the host and the FirePOWER module. At a minimum, you then see:

    • TCP 3-way handshake between the ASDM host and the ASA.
    • SSL tunnel established between the ASDM host and the ASA.
    • TCP 3-way handshake between the ASDM host and the FirePOWER module management IP address.
    • SSL tunnel established between the ASDM host and the FirePOWER module management IP address.

    Recommended Troubleshooting

    • If the TCP 3-way handshake fails, ensure that there is not asymmetric traffic or devices in the path that block the TCP packets.
    • If SSL fails, check if there is no device in the path doing man-in-the-middle (MITM) (the Server Certificate Issuer gives a hint for this).

    Verification 6

    In order to check the traffic to and from the FirePOWER module, enable capture on the asa_mgmt_plane interface. In the capture, you can see the:

    • ARP request from the ASDM host (packet 42).
    • ARP reply from the FirePOWER module (packet 43).
    • TCP 3-way handshake between the ASDM host and the FirePOWER module (packets 44-46).

    ASA5525# capture FP_MGMT interface asa_mgmt_plane
    ASA5525# show capture FP_MGMT | i 192.168.75.123
    …
    42: 20:27:28.532076 arp who-has 192.168.75.123 tell 192.168.75.22
    43: 20:27:28.532153 arp reply 192.168.75.123 is-at 6c:41:6a:a1:2b:f2
    44: 20:27:28.532473 192.168.75.22.48391 > 192.168.75.123.443: S 2861923942:2861923942(0) win 8192 <mss 1260,nop,wscale 2,nop,nop,sackOK>
    45: 20:27:28.532549 192.168.75.123.443 > 192.168.75.22.48391: S 1324352332:1324352332(0) ack 2861923943 win 14600 <mss 1460,nop,nop,sackOK,nop,wscale 7>
    46: 20:27:28.532839 192.168.75.22.48391 > 192.168.75.123.443: . ack 1324352333 win 16695

    Recommended Troubleshooting

    • Same as in Verification 5.

    Verification 7

    Verify that the ASDM user has privilege level 15. One way to confirm this is to enter the debug http 255 command while it connects via ASDM:

    ASA5525# debug http 255
debug http enabled at level 255.
HTTP: processing ASDM request [/admin/asdm_banner] with cookie-based authentication (aware_webvpn_conf.re2c:444)
HTTP: check admin session. Cookie index [2][c8a06c50]
HTTP: Admin session cookie [A27614B@20480@78CF@58989AACB80CE5159544A1B3EE62661F99D475DC]
HTTP: Admin session idle-timeout reset
HTTP: admin session verified =  [1]
HTTP: username = [user1], privilege = [14]

    Recommended Troubleshooting

    • If the privilege level is not 15, then try with a user that has level 15.

    Verification 8

    If between the ASDM host and the FirePOWER module there is network adddress translation (NAT) for the FirePOWER Management IP address, then you need to specify the NATed IP address:

    GUI input

    Recommended Troubleshooting

    • Captures at the end points (ASA/SFR and end-host) confirms this.

    Verification 9

    Make sure that the FirePOWER module is not already managed by FMC, because in that case the FirePOWER tabs in ASDM is missing:

    ASA5525# session sfr console
Opening console session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
> show managers
Managed locally.

>

    Another method is with the show module sfr details command:

    ASA5525# show module sfr details
Getting details from the Service Module, please wait...

Card Type:          FirePOWER Services Software Module
Model:              ASA5525
Hardware version:   N/A
Serial Number:      FCH1719J54R
Firmware version:   N/A
Software version:   6.1.0-330
MAC Address Range:  6c41.6aa1.2bf2 to 6c41.6aa1.2bf2
App. name:          ASA FirePOWER
App. Status:        Up
App. Status Desc:   Normal Operation
App. version:       6.1.0-330
Data Plane Status:  Up
Console session:    Ready
Status:             Up
DC addr:            No DC Configured
Mgmt IP addr:       192.168.75.123
Mgmt Network mask:  255.255.255.0
Mgmt Gateway:       192.168.75.23
Mgmt web ports:     443
Mgmt TLS enabled:   true

    Recommended Troubleshooting

    Verification 10

    Check the wireshark capture in order to ensure the ASDM client connects with a proper TLS version (for example, TLSv1.2).

    Recommended Troubleshooting

    • Tune the browser SSL settings.
    • Try with another browser.
    • Try from another end-host.

    Verification 11

    Verify in the Cisco ASA Compatibility guide that the ASA/ASDM images are compatible.

    Recommended Troubleshooting

    • Use a compatible ASDM image.

    Verification 12

    Verify in the Cisco ASA Compatibility guide that the FirePOWER device is compatible with the ASDM version.

    Recommended Troubleshooting

    • Use a compatible ASDM image.

    Related Information

    Revision History

    Revision Publish Date Comments
    2.0
    14-Jul-2023
    Recertification
    1.0
    14-Dec-2016
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    • Mikis Zafeiroudis
      Cisco TAC Engineer

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products