Cisco ASA Remote Management – SSH/ASDM

By default SSH, telnet or https management is disabled.

First of all we must have configured the management interface of the equipment, something similar to:

ASA-JMCristobal# sh run interface Management0/0
!
interface Management0/0
management-only
nameif management
security-level 100
ip address 10.1.1.10 255.255.255.0

Enable SSH

Step 1 – Configure the RSA keys

ASA-JMCristobal(config)# crypto key generate rsa modulus 1024
Keypair generation process begin. Please wait…

Step 2 – Set up at least one local user

ASA-JMCristobal(config)# username MyUser password MyPass privilege 15

Step 3 – Define that the authentication uses the local ASA database in SSH sessions.

ASA-JMCristobal(config)# aaa authentication ssh console LOCAL

Step 4 – Enable SSH and allow connections only to the management interface from any IP address:

ASA-JMCristobal(config)# ssh 0.0.0.0 0.0.0.0 management

You can define only some particular network segments or hosts to have SSH access, each network segment or host must be defined on a separate line. The above line management refers to the interface name and not the interface type/number.

Enable configuration by ASDM

ASDM is the GUI manager for the ASA.

Step 1 – Validate that a version of ASDM exists on the ASA

ASA-JMCristobal(config)# dir 
Directory of disk0:/
805673907  -rw-  33696476     16:31:35 Nov 17 2020  asdm.bin
1 file(s) total size: 33696476 bytes
21475885056 bytes total (21285044224 bytes free/99% free)

If the file does not exist, upload a version compatible with the equipment via FTP, SCP, or other protocol.

Step 2 – Configure at least one local user.

ASA-JMCristobal(config)# username MyUser password MyPass privilege 15

Step 3 – Define that the http authentication uses the ASA local database.

ASA-JMCristobal(config)# aaa authentication http console LOCAL

Step 4 – Enable http server

ASA-JMCristobal(config)# http server enable

Step 5 – Allow http connections only for the management interface from any IP address:

ASA-JMCristobal(config)# http 0.0.0.0 0.0.0.0 management

You can define only some particular network segments or hosts that have access with the ASDM; each network segment or host must be defined on a different line. The above line management refers to the interface name and not the interface type/number.

Now all that remains is to log in through a web browser to the IP address of the ASA to download the ASDM, install it and finally connect through this application