Adaptive Security Device Manager Hot Issues from Cisco TAC

ASDM: java.lang.NumberFormatException: For input string: "1 year 0" , Fixed CSCsr89144

Symptom: ASDM cannot be started after the ASA's lifetime exceeds one year with the following Java errors: Exception in thread "SGZ Loader: launchSgzApplet" java.lang.NumberFormatException: For input string: "1 year 0" at java.lang.NumberFormatException.forInputString(Unknown Source) at java.lang.Integer.parseInt(Unknown Source) at java.lang.Integer.parseInt(Unknown Source) at com.cisco.pdm.Check.h(DashoA10*..:1358) at com.cisco.pdm.Check.c(DashoA10*..:858) at com.cisco.pdm.Check.a(DashoA10*..:438) at com.cisco.pdm.PDMApplet.start(DashoA10*..:132) at com.cisco.nm.dice.loader.r.run(DashoA19*..:410)
Conditions: ASA running for more than one year with ASDM 6.0.3 or 6.1.
Workaround: Reload ASA. Additional Information The case of exactly one year and one day is addressed in a later defect, CSCsx24433, "ASDM fails to start with java.lang.StringIndexOutOfBoundsException error."

ASDM 5.0.x fails if running Java 6 Update 12 or above , Fixed CSCtb04872

Symptom: ASDM 5.0.x fails if running Java 6 Update 12 or above.
Conditions: Host is running Java 6 Update 12 or above.
Workaround: Use Java 6 Update 11 or below.

ASDM does not work with MAC OS 10.6 (Snow Leopard) , Fixed CSCtb73849

Symptom: ASDM fails to start when launched from the initial password dialog "OK" button. The Java console shows: Exception in thread "SGZ Loader: launchSgzApplet" java.lang.NoClassDefFoundError: apple/laf/ScreenMenuBar
Conditions: Starting up in either 64-bit or 32-bit Java 6 on MAC OS 10.6 (Snow Leopard).
Workaround: No generally-usable work-around has been found. Some adventurous users have copied the Apple Java update 5 implementation directories from the MacOS 10.5 (Leopard) implementation into a subdirectory of /System/Library/Frameworks/JavaVM.frameworks/ of MacOS 10.6, with appropriate renaming, but this unorthodox procedure has significant risk.
Further Problem Description: CSCta43480, "ASDM fails to launch on Mac OSX 10.5 with 64-bit Java update 4," was closed since updating to MacOS 10.5.8 and updating Java to Software update 5 resolves the issues.

Error while loading ASDM: "Unconnected sockets not implemented" , Fixed CSCsv12681

Symptom: While loading ASDM, a dialog is displayed that says: "ASDM cannot be loaded. Click OK to exit ASDM. Unconnected sockets not implemented" This occurs when using Java 6 Update 10 or later.
Conditions: ASDM version 5.0 or later running on ASA, PIX or FWSM and using Java 6 Update 10 or later.
Workaround: Use Java 6 Update 7.
Further Problem Description:

Cannot load ASDM with read-only user when DAP configured , Open CSCso46258

Symptom: Read-only user cannot load ASDM. ASDM will freeze loading (usually at 77%) or it will prompt the user to put in the credentials over and over again.
Conditions: Launch ASDM 6.2 to ASA when DAP is configured on the device.
Workaround: Put in command "privilege cmd level 5 mode exec command copy" with CLI.

ASDM is unable to read the configuration from the ASA , CSCsx39786

Symptom: When loading the ASDM, after the "Status" window parses the configuration, a pop-up box is shown that says, "ASDM is unable to read the configuration from the ASA. Please check the configuration and your connection and then try again by clicking the Refresh icon."
Conditions: This issue has been seen on ASA 7.2.4 and ASDM 5.2.4
Workaround: Downgrading to Java 6 Update 7 resolves the issue. Additional Information Although a fix is in engineering build ASDM 5.2.4.51, because of CSCsy20611, "ASDM does not parse access-list line remarks correctly," which interferes with changing ACLs, upgrading to engineering build ASDM 5.2.4.55 may give better results.

Creating rule from the log is not working (6.1.1.2.F) , Fixed CSCsu04242

Symptom: When using the ASDM Real-Time Log Viewer, if you right-click on a 106100 or 106023 and choose "show access-rule" or "create reverse access rule" you get an error "This syslog message has an invalid format"
Conditions: Use an affected version of ASDM.
Workaround: Create the rule manually or look at the access-lists manually.

Cannot perform ASDM backup with some CSD configs. , Fixed CSCtc49841

Symptom: Backup of ASA config/images fails through ASDM.
Conditions: "without-csd' is configured under a tunnel group and no CSD image is installed in the webvpn global config.
Workaround: -Remove the "without-csd" from the tunnel-groups configured on your ASA -Install a CSD image with the "csd image " command -Uncheck the CSD check boxes when selecting which components should be backup through ASDM.

New syslog info format for ASDM 6.1(3) breaks show/create access rule , Fixed CSCsr32487

Symptom: When using the ASDM Real-Time Log Viewer, if you right-click on a 106100 or 106023 and choose "show access-rule" or "create reverse access rule" you get an error "This syslog message has an invalid format".
Conditions: Use an affected version of ASDM.
Workaround: Create the rule manually or look at the access-lists manually.

ASDM will not allow interface as source or destination on ACL line , Fixed CSCtc81893

Symptom: Configuring an interface as source or destination in An ACE line ASDM 6.2 will report an error. Also if there is an ACL line that includes an interface as source or destination in the config already ASDM will shows the interface in the ACE. But you cannot configure it if it is not already in the config.
Conditions: Using ASDM to configure ACLs and using an interface as source or destination in an ACE.
Workaround: Use the Edit Access Rule dialog.
Further Problem Description:

ASDM does not parse access-list line remarks correctly , Fixed CSCsy20611

Symptom: Editing an ACL line Description in ASDM sends "access-list line remark " properly to the firewall. However, upon refreshing the configuration, ASDM does not properly parse that remark and place it back into the access-list table. To gather this information, ASDM requests a "https:// Conditions: This was observed on ASDM 5.2(4)54 and PIX 7.2(4)28.
Workaround: None.
Further Problem Description: pix(config)# show run access-l outside_in access-list outside_in remark hi access-list outside_in extended permit icmp any any echo-reply ASDM is not caching the "hi" remark to apply to the Description field in the ASDM table for the "permit icmp any any echo-reply" line.

number-of-rate option has wrong default for threat-detection config , Fixed CSCsv02654

Symptom: Clicking Enable for Top 10 Sources in Firewall Dashboard > Top Usage Status pane, sends incorrect command.
Conditions: Launch ASDM 6.1.5 to Cisco ASA device running 8.0.4 or 8.1.2 in single-routed mode. Navigate to Top Status Usage pane and click Enable.
Workaround: Configure correct value from CLI.

ASDM Real-Time Log Viewer does not filter with Filter button , Fixed CSCsl32325

Symptom: When using Java 1.6.0_03-b05, ASDM 5.2(2)F, and FWSM 3.2.2, the Real-Time Log Viewer does not filter correctly when pressing the Filter button.
Conditions: Use the following steps to reproduce the issue: 1) Launch FWSM and browse to Monitoring -> Logging -> View 2) Choose a particular IP for which you see logs, enter that IP in the Filter By box. 3) Click the Filter button. The logs will not filter. 4) Hit enter and the logs do filter. 5) After hitting enter, the IP will be in the drop-down list. The IP can then be selected and the Filter button can be pressed. Doing this will filter the logs properly.
Workaround: Press enter rather than clicking the Filter button.
Further Problem Description: The issue only occurs when entering a new IP in the Filter By box and clicking on the Filter button. This issue was observed on Windows XP SP2, but may be present on other OSes.

With a large config, ASDM takes a long time to change config windows , Open CSCtc53304

Symptom: With a large configuration file, changing configuration views takes a significant amount of time.
Conditions: The configuration file must be significantly large.
Workaround: None known.
Further Problem Description: None.

Unable to Manage AIP-SSM Running 6.1(1) from ASDM 5.2 , Fixed CSCsq34600

Symptom: When trying to manage Adaptive Intrusion Prevention Security Service Module (AIP-SSM) running 6.1(1) software from within Adaptive Security Device Manager (ASDM) version 5.2, an error window saying "bb" pops up.
Conditions: AIP-SSM with 6.1(1) software installed on it and ASDM 5.2.
Workaround: Manage the AIP-SSM directly through Intrusion Prevention System Device Manager (IDM).

ASDM: Disabling 1 L2L ipsec connection profile may also disable others , Fixed CSCsy80386

Symptom: With ASDM when there many site to site VPN connection profiles defined which share the group policy, if you disable one site to site VPN connection profile, then IPSEC will get disabled for all site to site VPN connection profiles (tunnels) that share the same group policy. This is confusing for customers and can cause a outage, where disabling one site to site vpn tunnel, can disable all other IPSEC vpn tunnels if they share the same group policy. This bug is specifically for the site to site VPN connection profiles. Clientless and remote access connection profiles are addressed by bug CSCsy58573.
Conditions: 1) When multiple ipsec site to site VPN connection profiles use the same group policy 2) One of the site to site VPN connection profiles is disabled
Workaround: Before disabling a site to site VPN connection profile, define a new group policy, and assign to the site to site VPN connection profile, and then disable the site to site VPN connection profile.

ASDM FWSM fails to display hitcounts on Access Rules page , Open CSCsz14320

Symptom: In a rare corner case, the ASDM page for "Access Rules" does not show hit counts.
Conditions: This was observed when using the ASDM software to monitor a FWSM.
Workaround: Use the command line to view hit counts using the output of "show access-list". This bug coupled with CSCta01974 results in ACL hits not being displayed on ASDM. This is expected behaviour.

ASDM NAT-control Option Window Behavior , Fixed CSCsj40690

Symptom: When being presented with the NAT-control option in ASDM, clicking anywhere in the space at the bottom can change the option to check/unchecked.
Conditions: Normal operation and hitting APPLY.
Workaround: Do not hit APPLY and always check if the option has changed.

DOC: asdm doesn't support "backup configuration" option in multicontext , Open CSCtd16847

Symptom: This is a documentation bug. Documentation for asdm shows a table where the "backup configuration" feature is available to. right now that section shows that this feature is available in multicontext mode, and supported from system context. this is not true, and this feature is not available in multicontext mode from any context.
Conditions: this is not a functionality bug, just a documentation bug.

ASDM parser for "wr mem" does not parse Error output properly , Open CSCtc80421

Symptom: In case a user saves the running config using ASDM, in case there is an error returned like %Error opening disk0:/.private/startup-config (Read-only file system) Error executing command [FAILED] ADSM will not catch the error and the user will think it saved the config.
Conditions: Running ASDM 6.2, using ASDM to save the running config and running into an error when running the command "write memory".
Workaround: Make sure you get rid of the error by clearing the flash. And then try saving again.
Further Problem Description: In case of such an error returned after saving the config (write memory) the full output of the command could be Building configuration... Cryptochecksum: xxxxx xxxxx xxxxx xxxxx %Error opening disk0:/.private/startup-config (Read-only file system) Error executing command [FAILED]

ASDM fails to start with java.lang.StringIndexOutOfBoundsException error , Fixed CSCsx24433

Symptom: ASDM cannot be started after the ASA's lifetime exceeds one year with the following Java errors: Exception in thread "SGZ Loader: launchSgzApplet" java.lang.StringIndexOutOfBoundsException: String index out of range: -1 at java.lang.String.substring(Unknown Source) at java.lang.String.substring(Unknown Source) at com.cisco.pdm.Check.h(DashoA10*..:1345) at com.cisco.pdm.Check.c(DashoA10*..:841) at com.cisco.pdm.Check.a(DashoA10*..:422) at com.cisco.pdm.PDMApplet.start(DashoA10*..:132) at com.cisco.nm.dice.loader.r.run(DashoA19*..:410)
Conditions: ASA running for one year and one day with ASDM 6.1. Even though CSCsr89144, "ASDM: java.lang.NumberFormatException: For input string: '1 year 0'," may be fixed in an earlier ASDM version, the case of one year and one day still will not work.
Workaround: 1. Reload ASA. or 2. If the ASDM version has CSCsr89144, "ASDM: java.lang.NumberFormatException: For input string: '1 year 0'," fixed as in ASDM 6.1(4.58) or later, then wait one day before using ASDM again.
Further Problem Description: For ASDM for FWSM see CSCsz84762, "port changes of CSCsx24433 to 61f branch."