Adaptive Security Device Manager Hot Issues from Cisco TAC

ASDM: java.lang.NumberFormatException: For input string: "1 year 0" , Fixed CSCsr89144

Symptom: ASDM cannot be started after the ASA's lifetime exceeds one year with the following Java errors: Exception in thread "SGZ Loader: launchSgzApplet" java.lang.NumberFormatException: For input string: "1 year 0" at java.lang.NumberFormatException.forInputString(Unknown Source) at java.lang.Integer.parseInt(Unknown Source) at java.lang.Integer.parseInt(Unknown Source) at com.cisco.pdm.Check.h(DashoA10*..:1358) at com.cisco.pdm.Check.c(DashoA10*..:858) at com.cisco.pdm.Check.a(DashoA10*..:438) at com.cisco.pdm.PDMApplet.start(DashoA10*..:132) at com.cisco.nm.dice.loader.r.run(DashoA19*..:410)
Conditions: ASA running for more than one year with ASDM 6.0.3 or 6.1.
Workaround: Reload ASA. Additional Information The case of exactly one year and one day is addressed in a later defect, CSCsx24433, "ASDM fails to start with java.lang.StringIndexOutOfBoundsException error."

Error while loading ASDM: "Unconnected sockets not implemented" , Fixed CSCsv12681

Symptom: While loading ASDM, a dialog is displayed that says: "ASDM cannot be loaded. Click OK to exit ASDM. Unconnected sockets not implemented" This occurs when using Java 6 Update 10 or later.
Conditions: ASDM version 5.0 or later running on ASA, PIX or FWSM and using Java 6 Update 10 or later.
Workaround: Use Java 6 Update 7.
Further Problem Description:

ASDM is unable to read the configuration from the ASA , CSCsx39786

Symptom: When loading the ASDM, after the "Status" window parses the configuration, a pop-up box is shown that says, "ASDM is unable to read the configuration from the ASA. Please check the configuration and your connection and then try again by clicking the Refresh icon."
Conditions: This issue has been seen on ASA 7.2.4 and ASDM 5.2.4
Workaround: Downgrading to Java 6 Update 7 resolves the issue. Additional Information Although a fix is in engineering build ASDM 5.2.4.51, because of CSCsy20611, "ASDM does not parse access-list line remarks correctly," which interferes with changing ACLs, upgrading to engineering build ASDM 5.2.4.55 may give better results.

ASDM: Disabling 1 connection profile entry may also disable others , Fixed CSCsy58573

Symptom: With ASDM when there many connection profiles defined which share the group policy, if you disable one connection profile, all connection profiles (tunnels) that share the same group policy. This is confusing for customers and can cause a outage, where disabling connection profile , can disable all other connection profiles share the same group policy. This bug only addresses the remote access and clientless connection profile scenario. Bug CSCsy80386 is filed for the site to site connection profile scenario.
Conditions: 1) When multiple connection profiles use the same group policy 2) one of the connection profiles is disabled
Workaround: Before disabling a connection profile, define a new group policy, and assign to the connection profile, and then disable the connection profile

, Fixed CSCsr46204

Symptom: There is currently a note in the ASDM 6.1.1 User Guide: "You can only restore backups to the same security appliance from which they were originally made. Also, although you can use the Tools > Backup Configurations option to back up a running configuration, you cannot use the Tools > Restore Configurations option to restore it. Instead, unzip and transfer the running-config.cfg file to the security appliance file system, then use the copy running-config.cfg startup-config command to restore the startup configuration file. Finally, reboot to load it to memory." It is true, the "Restore Configurations" feature will not restore the running config. This is counter-intuitive and unreasonable. If we are going to include functionality for backing up the config, we should include functionality for restoring the config.
Conditions: The running config must be backed up using the Tools -> Backup Configurations feature and then attempted to be restored using the Tools -> Restore Configurations feature.
Workaround: Unzip and transfer the running-config.cfg file to the security appliance file system, then use the copy running-config.cfg startup-config command to restore the startup configuration file. Finally, reboot to load it to memory.

, Open CSCte53326

Symptom: If the CA cert is bound with multiple trustpoints the ASDM doesn't allow to select a specific trustpoint in the crypto map section : Configuration > Site-to-Site VPN > Advanced > Crypto Maps Repro steps : 1. Configure 2 trustpoints. 2. Authenticate both the trustpoints with the same CA cert. 3. Try to bind one of them in the above section. It shows both but when you apply the command, it picks the one authenticated first.
Conditions: One CA cert associated with multiple trustpoints.
Workaround: Delete one of the trustpoints.

ASDM: SSL VPN Client Profile - need the ability to re-submit the command , Fixed CSCtc54761

Symptom: In ASDM, Configuration > Remote Access VPN > network (Client) Access > Advanced > SSL VPN > Client Settings, if you change the XML file for a profile and upload it back to the ASA, ASDM does not re-submit the command because it see's the command as the same (No changes made). Unfortunately, you need to re-issue the command so that the profile with the changes will be pushed down to the Clients.
Conditions: ASDM with a new AnyConnect Client profile.
Workaround: In the ASDM | Tools | Command Line Interface, select "Multiple Line" and type the following commands, then click Send: config terminal webvpn svc profiles YourProfileName disk0:/TheModifiedProfile.xml

SVC Image Order modification not refreshed in ASDM , Fixed CSCte58123

None Symptom: SVC Image Order modification not refreshed in ASDM causing problems while deleting one of the image through ASDM.
Conditions: SVC image order is modified through ASDM.
Workaround: Refresh the ASDM after every change made.

FWSM: :Asdm does not process acl cut and paste as expected , Open CSCte39873

Symptom: ASDM does not process acl cut and paste as expected when you attempt to "cut " and then "paste" an access-list line over to a different relative position within the acl.( Note that you do NOT use option "paste after" but "paste" on the position of intended line ).
Conditions: For E.G. assume that you attempt to "cut " and then "paste" line 5 to the position of line 1. Typically in a preview one should expect "no access-list line 5" and then see it being entered as line 1. But what you see here is that systematically from line 1 to line 4 are first removed , which makes line 5 automatically line 1. This behavior is seen only when a non-object-group entry is moved "over" to an object-group entry or vice-versa . In other scenarios it works as expected.
Workaround: None

ASDM does not read 30 word auth-prompt banner from config , Open CSCte35751

Symptom: 1) When the ASA config has a long (30 word) auth-prompt banner ASDM when reading the config it will show only 27 words in the Configuration > Device Management > Users AAA > Authentication Prompt > Prompt. field. 2) When setting the field in ASDM to a long 30 word string that exceeds the field space in ASDM the field will get full. If you put the cursor somewhere in the middle of the line to correct something you can't see the end of the line to correct it any more. The cursor cannot go to the end of the line for more correcting.
Conditions: Use ASDM to change/edit long auth-prompt ASDM banners.
Workaround: Use CLI.

Ability to clear CSC events enhancement , Open CSCte82934

Symptom: Unable to clear CSC events on ASDM CSC home screen
Conditions: ASDM with CSC module management
Workaround: Use the functionality in Monitoring > Trend Micro > Live Security Events

ASDM will not load interface graphs for ASA 5505 , Fixed CSCte47956

Symptom: ASDM 6.2.5 will not show any interface graphs when connecting to an ASA 5505. This only happens for monitor only users.
Conditions: This only occurs with ASDM 6.2 and an ASA 5505. Also, command authorization must be enabled. And while using the default ASDM command authorization configuration, only monitor-only users are affected.
Workaround: Do not use command authorization for users.

ASDM doesn't support object-group and network objects with same name , Open CSCso23263

Symptom: ASDM 5.2.3 and ASDM 5.2.3F do not support object groups and objects with the same name.
Conditions: Network object snd network object groups with the same names in ASDM 5.2.3 and ASDM 5.2.3.F
Workaround: If you have configure the object and the object group with the same name xxx and want to tje object group in an ACL use the drag 'n' drop feature instead. In the right-hand side window, drag the network object group "xxx" into the source or destination address cell, and it will generate the correct configuration. Note that if you make any changes in the Edit Access Rule dialog, it will revert back to the incorrect "host xxx" even if you do not change this field. Tip: If you enable the "Preview commands..." option in Tools > Preferences, you can see the exact CLIs that ASDM sends to the firewall.
Further Problem Description: In ASDM if you have an object group and an object with the same name, when trying to use them in an ACL the object will be used as the object group.

ASDM incorrectly displays 0 for ACL 'Hits' total in Access Rules config , Fixed CSCsu00875

Symptom: The access-list hit-count entries in ASDM might not be consistent with the true access-list hit counts as reported on the command line interface of the firewall. To see the hit-count totals from within ASDM, go to Configuration->Firewall-Access Rules and observe the 'Hits' column values. To see the hit-count totals from with the command line interface, issue the command 'show access-list' This bug causes the 'Hits' value within the ASDM GUI to show '0' instead of the actual value.
Conditions: The user must be using the ASDM GUI to view the hit-count totals for the access-lists on the firewall.
Workaround: The command line interface gives an accurate representation of the hit-counts of the ACL's. Use the command line command 'show access-list' to see the true hit counts.

ASDM backup config - does not properly back up pre-shared key for TG , Fixed CSCsy47949

Symptom: Pre-shared keys on the tunnel-group are not imported correctly to an ASA when restoration of configuration is done. Backup configuration is done through ASDM. (Tools ---> Backup Configurations.) During the backup configuration process, the pre-shared keys might be copied as "*" instead of the configured pre-shared key.
Conditions: Backup configuration process done through ASDM.
Workaround: Reset the pre-shared-key through CLI after configuration is imported to the ASA.

ASDM Completion status window stuck at 90% , Fixed CSCsx14802

Symptom: ASDM completion window stuck at 90% [ populating GUI modules ]
Conditions: So far, It has been seen on ASDM 6.1.5 after doing changes and swapping between multiples ASA
Workaround: Closing the completion window does not affect functionnality

ASDM launcher fails to update , Terminated CSCsl60970

Symptom: ASDM launcher reports a newer version available. The update is reported to be successful. However the launcher still reports version 5.2 running and new version available.
Conditions: ASDM upgrad from 5.2 to 6.0
Workaround: Remove files and windows registry entries manually,
Further Problem Description:

ASDM with CSC blank panels and left navigation only , Fixed CSCsv60678

Symptom: An ASA 5510 with an SSM-10 CSC module does not show any panel contents (home, configuration, or monitoring) running ASA 8.0.4.8 (base license) and ASDM 6.1.5.50. The device list, menus, and tool bar are displayed and continue to function, such as the Startup Wizard. ASDM did show panel contents with the device as received from the factory with ASA 7.2.4 and ASDM 5.2.4.
Conditions: SSM-10 CSC module installed. ASA 8.0.4.8 ASDM 6.1.5.50
Workaround: 1. Downgrade to the factory supplied default, ASA operating system 7.2.4, and ASDM 5.2.4. 2. Or, after powering the ASA off, remove the SSM-10 CSC module from the ASA.
Further Problem Description: Further analysis showed the issue also occurs if there is a CSC activation key rather than as originally described.

ASDM users with Privilege Level 0,1 Shouldn't Gain ASDM Access , Fixed CSCso63191

Symptom: ASDM users with privilege level 0 or 1 can view the configuration tab but portions of the config are missing, portions are the default config, and portions show errors because privilege level 0 and 1 users aren't allowed to view show commands. Users attempt to configure something and when they apply the configuration they receive errors "[ERROR] ^ % Invalid input detected at '^' marker." because they don't have privilege to apply these changes.
Conditions: ASDM user logs in with privilege level 0 or 1
Workaround: Use a privilege level of 2; this allows the user ASDM access but the user cannot access the configuration tab in ASDM.

Capability to Backup/Restore config/start-up configs , Fixed CSCsu90066

Symptom: Capability to Backup/Restore config/startup configs via ASDM Currently ASDM backsup only the running config, but not the startup-config. It also doesn't restore the running or startup-config which it should. It also doesn't restore Identity certificate and keys. It doesn't restore Local CA certificates.
Conditions: All versions of ASDM have this defect.
Workaround: Currently users have to extract configuration manually from the backup and manually upload it to PIX/ASA via CLI.
Further Problem Description: This behavior is documented in the ASDM Configuration Guide.

Error while reading specified file. Entry rdp cannot be imported. , Open CSCta15802

Symptom: "Error while reading specified file. Entry rdp cannot be imported." when trying to import rdp2 plug-in via ASDM.
Conditions: ASDM 6.2.1
Workaround: Manually enter rdp2 into the "Plug-in Name (Protocol)" menu.
Further Problem Description: