Scenario:
Make: Cisco ASA
Model: All ASA models (ASA 5506-X, ASA 5506W-X, ASA 5508-X, etc.)
Mode: CLI (Command Line Interface)
Description: In this article, we walk through a step-by-step method to configure and enable ASDM (GUI) access on a Cisco ASA. This configuration is valid both for a standalone firewall and for firewalls in high availability mode.
Cisco ASA uses a tool called ASDM (Adaptive Security Device Manager) for GUI access to Cisco firewalls. ASDM is Java-based and connects to the ASA over HTTPS (TCP/443). For a newly deployed Cisco ASA, it is a good idea to set up ASDM access alongside the CLI for management and maintenance. The tool is especially useful for anyone who is less comfortable managing firewalls from the CLI. An example of the ASDM login screen is shown below.
Just as you can reach the CLI of an unconfigured ASA through the console port, an ASA running its factory-default configuration can be reached over the GUI at the default IP address https://192.168.1.1.
Configuration
Step 1: SSH or Console
Access the ASA over SSH to make the changes. If SSH access is not configured yet, connect through the console and refer to our article on how to configure SSH access on Cisco ASA.
Step 2: Username and Password
Create a username and password on the ASA for authentication. Privilege level 15 gives the user full administrative access in ASDM.
edledge-asa#
edledge-asa# conf t
edledge-asa(config)# username admin password edledge privilege 15
Note: The passwords in this article are examples only. Always use a strong, unique password on a production firewall.
Step 3: Enable Password
Set the enable password used to enter privileged mode.
edledge-asa(config)# enable password edledge
Step 4: Local AAA Authentication
Enable LOCAL AAA authentication so that HTTPS (ASDM) connections to the ASA are authenticated against the local username.
edledge-asa(config)# aaa authentication http console LOCAL
Note: The keyword “LOCAL” must be typed in capital letters.
Step 5: Management Access (Optional)
This command is only needed if you will manage the ASA over a VPN tunnel. It lets you reach the ASA on the IP address of the named interface (for example inside, management, or maintenance) when you connect through the VPN.
edledge-asa(config)# management-access inside
Step 6: Enable the HTTP Server
Enable the HTTP server by running the command below.
edledge-asa(config)# http server enable
Step 7: Allow Subnets for ASDM Access
Define the subnets or IP addresses that are allowed ASDM access to the ASA, and the interface they connect through. The interface name must match the nameif configured on your ASA.
edledge-asa(config)# http 10.0.1.0 255.255.255.0 inside
edledge-asa(config)# http 10.0.2.0 255.255.255.0 inside
Step 8: Save the Configuration
Save the configuration so the changes survive a reload.
edledge-asa(config)# write memory
Step 9: Confirmation
Now open the firewall’s IP address or hostname in a browser (https://ip.address.of.firewall), or install the ASDM launcher and connect to the firewall from there.
Note: Because LOCAL authentication is enabled in Step 4, log in to ASDM with the username and password created in Step 2. With privilege level 15, ASDM takes you straight into privileged mode.
Once ASDM access is configured, the firewall is ready to be managed remotely. Follow the link for the FirePOWER license activation steps via ASDM. If you want to configure high availability or failover on Cisco ASA firewalls, don’t forget to read the linked article.
Disclaimer: This article is for educational purposes only and is not professional financial, medical, or legal advice. It may contain affiliate links, which earn us a small commission at no extra cost to you. See our Disclaimer and Affiliate Disclosure.
Article ID: EA00054