Downloads |
 Feedback
|
Table Of Contents
Cisco ASDM Release Notes Version 5.1(2)
Client PC Operating System and Browser Requirements
Upgrading to a New ASDM Release
Starting ASDM from the ASDM Launcher
Starting ASDM from a Web Browser
Effects of Unsupported Commands
Ignored and View-Only Commands
Obtaining Documentation and Submitting a Service Request
Cisco ASDM Release Notes Version 5.1(2)
March 2006
This document contains release information for Cisco ASDM Version 5.1(2), which runs with Cisco PIX 500 series and Cisco ASA 5500 series adaptive security appliance software Version 7.1(2). This document includes the following sections:
•
Obtaining Documentation and Submitting a Service Request
Introduction
Cisco Adaptive Security Device Manager (ASDM) delivers world-class security management and monitoring services for Cisco PIX 500 and ASA 5500 series adaptive security appliances through an intuitive, easy-to-use management interface. Bundled with supported security appliances, the device manager accelerates security appliance deployment with intelligent wizards, robust administration tools, and versatile monitoring services that complement the advanced security and networking features offered by Cisco PIX 500 and ASA 5500 series adaptive security appliance software Version 7.1(2). Its secure design enables anytime, anywhere access to security appliances.
Important Notes
•
•
If you are using a non-English keyboard or usually type in language other than English, be careful not to enter non-English characters accidentally.
For a workaround, see caveat CSCeh39437.
System Requirements
This section includes the following topics:
•
Hardware Requirements
ASDM software runs on the following platforms:
•
•
•
•
•
•
•
Note
For more information on minimum hardware requirements, see:
http://www.cisco.com/en/US/docs/security/asa/asa70/asdm50/webhelp/sysreq.html
Certain features, such as load balancing and QoS, require particular hardware platforms. Other features require licensing. For more information on feature support for each platform license, see:
http://www.cisco.com/en/US/docs/security/asa/asa70/asdm50/webhelp/gen_info_licenses.html
Client PC Operating System and Browser Requirements
Table 1 lists the supported and recommended PC operating systems and browsers for Version 5.1(2). While ASDM might work on other browsers and browser versions, these are the only officially supported browsers. Note that unlike earlier PDM releases, you must have the Java Plug-in or J2SE installed. The native JVM on Windows is no longer supported and does not work.
Table 1 Operating System, Browser, and Java Requirements
Windows1
Windows 2000 (Service Pack 4) or Windows XP operating systems
Internet Explorer 6.0 with Java Plug-in2 1.4.2 or 5.0 (1.5)
Note
Netscape 7.1/7.2 with Java Plug-in2 1.4.2 or 5.0 (1.5)
J2SE 1.4.2 or 5.0 (1.5)
SSL Encryption Settings—All available encryption options are enabled for SSL in the browser preferences.
Sun Solaris
Sun Solaris 8 or 9 running CDE window manager
Mozilla 1.7.3 with Java Plug-in2 1.4.2 or 5.0 (1.5)
Not available.
Linux
Red Hat Linux 9.0 or Red Hat Linux WS, Version 3 running GNOME or KDE
Mozilla 1.7.3 with Java Plug-in2 1.4.2
Not available.
1 ASDM is not supported on Windows 3.1, 95, 98, ME or Windows NT4.
2 Download the latest Java Plug-in or J2SE from http://java.sun.com/.
Platform Feature Licenses
Table 2 lists the feature support for the ASA 5500 series adaptive security appliances.
Table 3 lists the feature support for the PIX 500 series security appliances.
Note
Table 2 ASA 5500 Series Adaptive Security Appliance License Features
Security Contexts
No support
No support
VPN Sessions1
250 combined IPSec and WebVPN
250 combined IPSec and WebVPN
Max. IPSec Sessions
250
250
Max. WebVPN Sessions
2
Optional Licenses:
2
Optional Licenses:
10
25
50
100
250
10
25
50
100
250
VPN Load Balancing
No support
No support
Failover
None
Active/Standby
GTP/GPRS
No support
No support
Max. VLANs
10
25
Concurrent Firewall Connections2
50 K
130 K
Max. Physical Interfaces
3 at 10/100 plus the Management interface for management traffic only (to-the-security-appliance)
Unlimited
Encryption
Base (DES)
Optional license:
Strong (3DES/AES)Base (DES)
Optional license:
Strong (3DES/AES)Min. RAM
256 MB
256 MB
Security Contexts
2
Optional Licenses:
5
10
20
VPN Sessions1
750 combined IPSec and WebVPN
Max. IPSec Sessions
750
Max. WebVPN Sessions
2
Optional Licenses:
10
25
50
100
250
500
750
VPN Load Balancing
Supported
Failover
Active/Standby
Active/ActiveGTP/GPRS
None
Optional license: Enabled
Max. VLANs
100
Concurrent Firewall Connections2
280 K
Max. Physical Interfaces
Unlimited
Encryption
Base (DES)
Optional license: Strong (3DES/AES)
Min. RAM
512 MB
Security Contexts
2
Optional licenses:
5
10
20
50
VPN Sessions1
5000 combined IPSec and WebVPN
Max. IPSec Sessions
5000
Max. WebVPN Sessions
2
Optional Licenses:
10
25
50
100
250
500
750
1000
2500
VPN Load Balancing
Supported
Failover
Active/Standby
Active/ActiveGTP/GPRS
None
Optional license: Enabled
Max. VLANs
200
Concurrent Firewall Connections2
400 K
Max. Physical Interfaces
Unlimited
Encryption
Base (DES)
Optional license: Strong (3DES/AES)
Min. RAM
1024 MB
1 Although the maximum IPSec and WebVPN sessions add up to more than the maximum VPN sessions, the combined sessions should not exceed the VPN session limit. If you exceed the maximum VPN sessions, you can overload the security appliance, so be sure to size your network appropriately.
2 The concurrent firewall connections are based on a traffic mix of 80% TCP and 20% UDP, with one host and one dynamic translation for every four connections.
Table 3 PIX 500 Series Security Appliance License Features
Security Contexts
No support
2
Optional license: 5
2
Optional license: 5
2
Optional license: 5
IPSec Sessions
2000
2000
2000
2000
WebVPN Sessions
No support
No support
No support
No support
VPN Load Balancing
No support
No support
No support
No support
Failover
No support
Active/Standby
Active/ActiveActive/Standby
Active/Standby
Active/ActiveGTP/GPRS
None
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledMax. VLANs
10
25
25
25
Concurrent Firewall Connections2
48 K
130 K
130 K
130 K
Max. Physical Interfaces
3
6
6
6
Encryption
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Min. RAM
64 MB
128 MB
128 MB
128 MB
Security Contexts
No support
2
Optional licenses:
2
Optional licenses:
2
Optional licenses:
5
10
20
50
5
10
20
50
5
10
20
50
IPSec Sessions
2000
2000
2000
2000
WebVPN Sessions
No support
No support
No support
No support
VPN Load Balancing
No support
No support
No support
No support
Failover
No support
Active/Standby
Active/ActiveActive/Standby
Active/Standby
Active/ActiveGTP/GPRS
None
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledMax. VLANs
25
100
100
100
Concurrent Firewall Connections2
140 K
280 K
280 K
280 K
Max. Physical Interfaces
6
10
10
10
Encryption
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Min. RAM
128 MB
256 MB
256 MB
256 MB
Security Contexts
No support
2
Optional licenses:
2
Optional licenses:
2
Optional licenses:
5
10
20
50
5
10
20
50
5
10
20
50
IPSec Sessions
2000
2000
2000
2000
WebVPN Sessions
No support
No support
No support
No support
VPN Load Balancing
No support
No support
No support
No support
Failover
No support
Active/Standby
Active/ActiveActive/Standby
Active/Standby
Active/ActiveGTP/GPRS
None
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledNone
Optional license:
EnabledMax. VLANs
50
150
150
150
Concurrent Firewall Connections2
250 K
500 K
500 K
500 K
Max. Physical Interfaces
8
14
14
14
Encryption
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
None
Optional licenses:
Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Base (DES)
Strong (3DES/
AES)Min. RAM
512 MB
1024 MB
1024 MB
1024 MB
1 This license can only be used in a failover pair with another unit with a UR license. Both units must be the same model.
2 The concurrent firewall connections are based on a traffic mix of 80% TCP and 20% UDP, with one host and one dynamic translation for every four connections.
Upgrading ASDM
This section describes how to upgrade ASDM. If you have a Cisco.com login, you can obtain ASDM from the following website:
http://www.cisco.com/cisco/software/navigator.html
This section includes the following topics:
•
Upgrading from PDM
Before you upgrade your device manager, upgrade your platform software to Version 7.0. See theGuide for Cisco PIX 6.2 and 6.3 Users Upgrading to Cisco PIX Software Version 7.0 for more information.
To upgrade to ASDM, perform the following steps:
Step 1
Step 2
hostname> enablepassword:hostname#Step 3
Step 4
hostname# delete flash:/pdmStep 5
•
hostname# copy tftp://server_ip/pathtofile flash:/asdm_filename•
hostname# copy ftp://server_ip/pathtofile flash:/asdm_filenameFor more information on the copy command and its options, see the Cisco Security Appliance Command Reference.
Step 6
hostname# configure terminalhostname(config)# asdm image flash:/asdm_filenameThis command lets you identify the image to load if you have multiple ASDM images in Flash memory.
Step 7
hostname(config)# http server enableStep 8
hostname(config)# http ip_address mask interfaceEnter 0 for the ip_address and mask to allow all IP addresses.
Step 9
hostname(config)# write memory
Deleting Your Old Cache
In early beta releases of ASDM and in previous releases of PDM (Versions 4.1 and earlier), the device manager stored its cache in <userdir>\pdmcache. For example, d:\documents and settings\jones\pdmcache.
Now, the cache directory for ASDM is in <user dir>\.asdm\cache.
The File > Clear ASDM Cache option in ASDM clears this new cache directory. It does not clear the old one. To free up space on your system, if you are no longer using your older versions of PDM or ASDM, delete your pdmcache directory manually.
Upgrading to a New ASDM Release
If you have a previous release of ASDM on your security appliance and want to upgrade to the latest release, you can do so from within ASDM. We recommend that you upgrade the ASDM image before the platform image. ASDM is backwards compatible, so you can upgrade the platform image using the new ASDM; you cannot use an old ASDM with a new platform image.
To upgrade ASDM, perform the following steps:
Step 1
Step 2
Step 3
Step 4
Step 5
If your security appliance does not have enough memory to hold two ASDM images, overwrite the old image with the new one by specifiying the same destination filename. You can reanme the image after it was uploaded using Tools > File Management.
If you have enough memory for both versions, you can specify a different name for the new version. If you need to revert to the old version, it is still in your Flash memory.
Step 6
When ASDM is finished uploading, you see the following message:
"ASDM Image is Uploaded to Flash Successfully."
Step 7
Step 8
Step 9
To reload the new image, reload the security appliance using the Tools > System Reload tool.
Getting Started with ASDM
This section describes how to connect to ASDM and start your configuration. If you are using the security appliance for the first time, your security appliance might include a default configuration. You can connect to a default IP address with ASDM so you can immediately start to configure the security appliance from ASDM. If your platform does not support a default configuration, you can log in to the CLI and run the setup command to establish connectivity. See "Before You Begin" for more detailed information about networking.
This section includes the following topics:
•
•
•
Before You Begin
If your security appliance includes a factory default configuration, you can connect to the default management address of 192.168.1.1 with ASDM. On the ASA 5500 series adaptive security appliance, the interface to which you connect with ASDM is Management 0/0. For the PIX 500 series security appliance, the interface to which you connect with ASDM is Ethernet 1. To restore the default configuration, enter the configure factory-default command at the security appliance CLI.
Make sure the PC is on the same network as the security appliance. You can use DHCP on the client to obtain an IP address from the security appliance, or you can set the IP address to a 192.168.1.0/24 network address.
If your platform does not support the factory default configuration, or you want to add to an existing configuration to make it accessible for ASDM, access the security appliance CLI according to the Cisco Security Appliance Command Line Configuration Guide, and enter the setup command. The setup command prompts you for a minimal configuration to connect to the security appliance using ASDM.
Note
Downloading the ASDM Launcher
The ASDM Launcher is for Windows only. The ASDM Launcher is an improvement over running ASDM in a Java Applet. The ASDM Launcher avoids double authentication and certificate dialog boxes, launches faster, and caches previously-entered IP addresses and usernames.
To download the ASDM launcher, perform the following steps:
Step 1
https://interface_ip_addressIn transparent firewall mode, enter the management IP address.
Note
Step 2
A page displays with the following buttons:
•
•
Step 3
The installer downloads to your PC.
Step 4
Starting ASDM from the ASDM Launcher
The ASDM Launcher is for Windows only.
To start ASDM from the ASDM Launcher, perform the following steps:
Step 1
Step 2
If there is a new version of ASDM on the security appliance, the ASDM Launcher automatically downloads it before starting ASDM.
Starting ASDM from a Web Browser
To start ASDM from a web browser, perform the following steps:
Step 1
https://interface_ip_addressIn transparent firewall mode, enter the management IP address.
Note
Step 2
A page displays with the following buttons:
•
•
Step 3
Step 4
Using the Startup Wizard
The Startup Wizard helps you easily configure a single mode security appliance or a context in multiple context mode.
Use the Startup Wizard to configure the basic set-up of your security appliance:
Step 1
•
a.
b.
•
a.
b.
c.
d.
e.
f.
Step 2
Step 3
Step 4
Using the VPN Wizard
The VPN Wizard configures basic VPN access for LAN-to-LAN or remote client access. The VPN Wizard is available only for security appliances running in single context mode and routed (not transparent) firewall mode.
Step 1
Step 2
Step 3
Step 4
Configuring Failover
This section describes how to implement failover on security appliances connected via a LAN.
If you are connecting two ASA security appliances for failover, you must connect them via a LAN. If you are connecting two PIX security appliances, you can connect them using either a LAN or a serial cable.
Tip
As specified in the Cisco Security Appliance Command Line Configuration Guide, both devices must have appropriate licenses and have the same hardware configuration.
Before you begin, decide on active and standby IP addresses for the interfaces ASDM connects through on the primary and secondary devices. These IP addresses must be assigned to device interfaces with HTTPS access.
To configure LAN failover on your security appliance, perform the following steps:
Step 1
Step 2
Step 3
Step 4
a.
b.
Step 5
a.
b.
Note
Step 6
a.
b.
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
The secondary device should now enter standby failover state using the standby IP addresses. Any further configuration of the active device or an active context is replicated to the standby device or the corresponding standby context.
Securing the Failover Key
To prevent the failover key from being replicated to the peer unit in clear text for an existing failover configuration, disable failover on the active unit (or in the system execution space on the unit that has failover group 1 in the active state), enter the failover key on both units, and then reenable failover. When failover is reenabled, the failover communication is encrypted with the key.
Follow this procedure on the active device:
Step 1
a.
b.
Step 2
a.
b.
Step 3
Step 4
a.
b.
Step 5
Step 6
Printing from ASDM
Note
If you want to print from within ASDM, start ASDM in application mode. Printing is not supported in applet mode in this release.ASDM supports printing for the following features:
•
•
•
•
•
Unsupported Commands
ASDM does not support the complete command set of the CLI. In most cases, ASDM ignores unsupported commands, and they can remain in your configuration. In the case of the alias command, ASDM enters into Monitor-only mode until you remove the command from your configuration.
See the following sections for more information:
•
•
Effects of Unsupported Commands
•
•
•
Monitor-only mode allows access to the following functions:
–
–
To exit Monitor-only mode, use the CLI tool or access the security appliance console, and remove the alias command. You can use outside NAT instead of the alias command. See the Cisco Security Appliance Command Reference for more information.
Note
Ignored and View-Only Commands
The following table lists commands that ASDM supports in the configuration when added by the CLI, but that cannot be added or edited in ASDM. If ASDM ignores the command, it does not appear in the ASDM GUI at all. If it is view-only, then the command appears in the GUI, but you cannot edit it.
ASDM Limitations
ASDM does not support the one-time password (OTP) authentication mechanism.
Other CLI Limitations
•
ip address inside 192.168.2.1 255.255.0.255•
Do you really want to replace them? [yes/no]:WARNING: You already have RSA ke0000000000000$A keyInput line must be less than 16 characters in length.%Please answer 'yes' or 'no'.Do you really want to replace them [yes/no]:%ERROR: Timed out waiting for a response.ERROR: Failed to create new RSA keys names <Default-RSA-key>For commands that have a noconfirm option, use the noconfirm option when entering the CLI command. For example, enter the crypto key generate rsa noconfirm command.
Caveats
This section describes caveats for the 5.1.2 version, and includes the following topics:
For your convenience in locating caveats in Cisco's Bug Toolkit, the caveat titles listed in this section are drawn directly from the Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation might be necessary to provide the most complete and concise description. The only modifications made to these titles are as follows:
•
•
•
Note
http://tools.cisco.com/Support/BugToolKit/
To become a registered cisco.com user, go to the following website:
http://tools.cisco.com/RPF/register/register.do
Open Caveats
Table 4 Open Caveats
CSCsd06006
Syslog: Create Rule feature may not pre-assign the correct direction
Resolved Caveats
Related Documentation
For additional information on ASDM or its platforms, see the ASDM online Help or the following documentation found on Cisco.com:
•
•
•
•
•
•
•
•
•
•
•
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0601R)
© 2006 Cisco Systems, Inc.
All rights reserved
