Introduction
This document describes how ASDM software communicates with the Adaptive Security Appliance (ASA) and a FirePOWER software module installed on it.
Background information
A FirePOWER module that is installed on an ASA can be managed by either:
- Firepower Management Center (FMC) - This is the off-box management solution.
- Adaptive Security Device Manager (ASDM) - This is the on-box management solution.
Prerequisites
Requirements
An ASA configuration to enable ASDM management:
ASA5525(config)# interface GigabitEthernet0/0
ASA5525(config-if)# nameif INSIDE
ASA5525(config-if)# security-level 100
ASA5525(config-if)# ip address 192.168.75.23 255.255.255.0
ASA5525(config-if)# no shutdown
ASA5525(config)#
ASA5525(config)# http server enable
ASA5525(config)# http 192.168.75.0 255.255.255.0 INSIDE
ASA5525(config)# asdm image disk0:/asdm-762150.bin
ASA5525(config)#
ASA5525(config)# aaa authentication http console LOCAL
ASA5525(config)# username cisco password cisco
Check the compatibility between the ASA/SFR module, otherwise the FirePOWER tabs are not seen.
Additionally, on the ASA the 3DES/AES license must be enabled:
ASA5525# show version | in 3DES
Encryption-3DES-AES : Enabled perpetual
Ensure the ASDM client system runs a supported version of Java JRE.
Components Used
- A Microsoft Windows 7 host
- ASA5525-X that runs ASA Version 9.6(2.3)
- ASDM Version 7.6.2.150
- FirePOWER software module 6.1.0-330
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Architecture
The ASA has three internal interfaces:
- asa_dataplane - It is used to redirect packets from the ASA Data Path to the FirePOWER software module.
- asa_mgmt_plane - It is used to allow the FirePOWER management interface to communicate with the network.
- cplane - Control Plane interface that is used to transfer keepalives between the ASA and the FirePOWER module.
You can capture traffic in all internal interfaces:
ASA5525# capture CAP interface ?
asa_dataplane Capture packets on dataplane interface
asa_mgmt_plane Capture packets on managementplane interface
cplane Capture packets on controlplane interface
This can be visualized as follows:
Background Operation When a User Connects to an ASA via ASDM
Consider this topology:
When a user initiates an ASDM connection to the ASA, these events occur:
Step 1 - The User Initiates the ASDM Connection
The user specifies the ASA IP address used for HTTP management, enters the credentials, and initiates a connection towards the ASA:
In the background, an SSL tunnel between the ASDM and the ASA is established:
This can be visualized as follows:
Step 2 - The ASDM Discovers the ASA Configuration and the FirePOWER Module IP Address
Enter the debug http 255 command on the ASA in order to show all the checks that are done in the background when the ASDM connects to the ASA:
ASA5525# debug http 255
…
HTTP: processing ASDM request [/admin/exec/show+module] with cookie-based authentication
HTTP: processing GET URL '/admin/exec/show+module' from host 192.168.75.22
HTTP: processing ASDM request [/admin/exec/show+cluster+interface-mode] with cookie-based authentication
HTTP: processing GET URL '/admin/exec/show+cluster+interface-mode' from host 192.168.75.22
HTTP: processing ASDM request [/admin/exec/show+cluster+info] with cookie-based authentication
HTTP: processing GET URL '/admin/exec/show+cluster+info' from host 192.168.75.22
HTTP: processing ASDM request [/admin/exec/show+module+sfr+details] with cookie-based authentication
HTTP: processing GET URL '/admin/exec/show+module+sfr+details' from host 192.168.75.22
- show module - The ASDM discovers the ASA modules.
- show module sfr details - The ASDM discovers the module details, which include the FirePOWER management IP address.
These are seen in the background as a series of SSL connections from the PC towards the ASA IP address:
Step 3 - The ASDM Initiates Communication Towards the FirePOWER Module
Since the ASDM knows the FirePOWER management IP address, it initiates SSL sessions towards the module:
This is seen in the background as SSL connections from the ASDM host towards the FirePOWER management IP address:
This can be visualized as follows:
The ASDM authenticates the FirePOWER and a security warning is shown since the FirePOWER Certificate is self-signed:
Step 4 - The ASDM Retrieves the FirePOWER Menu Items
After the successful authentication, the ASDM retrieves the Menu Items from the FirePOWER device:
The retrieved tabs are shown in this example:
It also retrieves the ASA FirePOWER Configuration Menu Item:
Troubleshoot
In case ASDM cannot establish an SSL tunnel with the FirePOWER Management IP address, it only loads this FirePOWER Menu Item:
The ASA FirePOWER Configuration Item is missing as well:
Verification 1
Make sure that the ASA management interface is UP and the switchport connected to it is in the proper VLAN:
ASA5525# show interface ip brief | include Interface|Management0/0
Interface IP-Address OK? Method Status Protocol
Management0/0 unassigned YES unset up up
Recommended Troubleshooting
- Set the proper VLAN.
- Bring the port UP (check the cable, check the switchport configuration (speed/duplex/shut)).
Verification 2
Make sure that the FirePOWER module is fully initialized, UP, and running:
ASA5525# show module sfr details
Getting details from the Service Module, please wait...
Card Type: FirePOWER Services Software Module
Model: ASA5525
Hardware version: N/A
Serial Number: FCH1719J54R
Firmware version: N/A
Software version: 6.1.0-330
MAC Address Range: 6c41.6aa1.2bf2 to 6c41.6aa1.2bf2
App. name: ASA FirePOWER
App. Status: Up
App. Status Desc: Normal Operation
App. version: 6.1.0-330
Data Plane Status: Up
Console session: Ready
Status: Up
DC addr: No DC Configured
Mgmt IP addr: 192.168.75.123
Mgmt Network mask: 255.255.255.0
Mgmt Gateway: 192.168.75.23
Mgmt web ports: 443
Mgmt TLS enabled: true
A5525# session sfr console
Opening console session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
> show version
--------------------[ FP5525-3 ]--------------------
Model : ASA5525 (72) Version 6.1.0 (Build 330)
UUID : 71fd1be4-7641-11e6-87e4-d6ca846264e3
Rules update version : 2016-03-28-001-vrt
VDB version : 270
----------------------------------------------------
>
Recommended Troubleshooting
- Check the output of the show module sfr log console command for errors or failures.
Verification 3
Check basic connectivity between the ASDM host and the FirePOWER module management IP with commands such as ping and tracert/traceroute:
Recommended Troubleshooting
- Check routing along the path.
- Verify that there are no devices in the path that block the traffic.
Verification 4
If the ASDM host and the FirePOWER management IP address are in the same Layer 3 network, check the Address Resolution Protocol (ARP) table on the ASDM host:
Recommended Troubleshooting
- If there are no ARP entries, use Wireshark in order to check the ARP communication. Ensure the MAC addresses of the packets are correct.
- If there are ARP entries, ensure they are correct.
Verification 5
Enable capture on the ASDM device while you connect via ASDM in order to see if there is proper TCP communication between the host and the FirePOWER module. At a minimum, you then see:
- TCP 3-way handshake between the ASDM host and the ASA.
- SSL tunnel established between the ASDM host and the ASA.
- TCP 3-way handshake between the ASDM host and the FirePOWER module management IP address.
- SSL tunnel established between the ASDM host and the FirePOWER module management IP address.
Recommended Troubleshooting
- If the TCP 3-way handshake fails, ensure that there is not asymmetric traffic or devices in the path that block the TCP packets.
- If SSL fails, check if there is no device in the path doing man-in-the-middle (MITM) (the Server Certificate Issuer gives a hint for this).
Verification 6
In order to check the traffic to and from the FirePOWER module, enable capture on the asa_mgmt_plane interface. In the capture, you can see the:
- ARP request from the ASDM host (packet 42).
- ARP reply from the FirePOWER module (packet 43).
- TCP 3-way handshake between the ASDM host and the FirePOWER module (packets 44-46).
ASA5525# capture FP_MGMT interface asa_mgmt_plane
ASA5525# show capture FP_MGMT | i 192.168.75.123
…
42: 20:27:28.532076 arp who-has 192.168.75.123 tell 192.168.75.22
43: 20:27:28.532153 arp reply 192.168.75.123 is-at 6c:41:6a:a1:2b:f2
44: 20:27:28.532473 192.168.75.22.48391 > 192.168.75.123.443: S 2861923942:2861923942(0) win 8192 <mss 1260,nop,wscale 2,nop,nop,sackOK>
45: 20:27:28.532549 192.168.75.123.443 > 192.168.75.22.48391: S 1324352332:1324352332(0) ack 2861923943 win 14600 <mss 1460,nop,nop,sackOK,nop,wscale 7>
46: 20:27:28.532839 192.168.75.22.48391 > 192.168.75.123.443: . ack 1324352333 win 16695
Recommended Troubleshooting
- Same as in Verification 5.
Verification 7
Verify that the ASDM user has privilege level 15. One way to confirm this is to enter the debug http 255 command while it connects via ASDM:
ASA5525# debug http 255
debug http enabled at level 255.
HTTP: processing ASDM request [/admin/asdm_banner] with cookie-based authentication (aware_webvpn_conf.re2c:444)
HTTP: check admin session. Cookie index [2][c8a06c50]
HTTP: Admin session cookie [A27614B@20480@78CF@58989AACB80CE5159544A1B3EE62661F99D475DC]
HTTP: Admin session idle-timeout reset
HTTP: admin session verified = [1]
HTTP: username = [user1], privilege = [14]
Recommended Troubleshooting
- If the privilege level is not 15, then try with a user that has level 15.
Verification 8
If between the ASDM host and the FirePOWER module there is network adddress translation (NAT) for the FirePOWER Management IP address, then you need to specify the NATed IP address:
Recommended Troubleshooting
- Captures at the end points (ASA/SFR and end-host) confirms this.
Verification 9
Make sure that the FirePOWER module is not already managed by FMC, because in that case the FirePOWER tabs in ASDM is missing:
ASA5525# session sfr console
Opening console session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
> show managers
Managed locally.
>
Another method is with the show module sfr details command:
ASA5525# show module sfr details
Getting details from the Service Module, please wait...
Card Type: FirePOWER Services Software Module
Model: ASA5525
Hardware version: N/A
Serial Number: FCH1719J54R
Firmware version: N/A
Software version: 6.1.0-330
MAC Address Range: 6c41.6aa1.2bf2 to 6c41.6aa1.2bf2
App. name: ASA FirePOWER
App. Status: Up
App. Status Desc: Normal Operation
App. version: 6.1.0-330
Data Plane Status: Up
Console session: Ready
Status: Up
DC addr: No DC Configured
Mgmt IP addr: 192.168.75.123
Mgmt Network mask: 255.255.255.0
Mgmt Gateway: 192.168.75.23
Mgmt web ports: 443
Mgmt TLS enabled: true
Recommended Troubleshooting
Verification 10
Check the wireshark capture in order to ensure the ASDM client connects with a proper TLS version (for example, TLSv1.2).
Recommended Troubleshooting
- Tune the browser SSL settings.
- Try with another browser.
- Try from another end-host.
Verification 11
Verify in the Cisco ASA Compatibility guide that the ASA/ASDM images are compatible.
Recommended Troubleshooting
- Use a compatible ASDM image.
Verification 12
Verify in the Cisco ASA Compatibility guide that the FirePOWER device is compatible with the ASDM version.
Recommended Troubleshooting
- Use a compatible ASDM image.
Related Information