Tuesday, April 10, 2012

Can't ASDM to ASA 5505

I had to format the flash on my ASA 5505 and reload images recently and after that, I could not access the device through ASDM. SSH and Telnet access were fine. All the ASDM related commands were there and there was no compatibility issue with asdm image or Java runtime. Wireshark show "Alert (level: Fatal, Description: Handshake Failure)" right after I entered the device IP.

It turned out this command caused the problem: "ssl encryption des-sha1"

After the flash was formated, the VPN-3DES-AES feature was gone. If you notice the feature is disabled in "show ver". The "ssl encryption des-sha1" was generated by default and remained even after VPN-3DES-AES license was activated.

Here is a good Cisco article for ASDM troubleshooting:
http://www.cisco.com/en/US/products/ps6121/products_tech_note09186a0080aaeff5.shtml#prblm4