asked on

ASA 5505 steps on my SBS 2008 SSL certificate

Hello experts,
Hey, I just put in a new ASA 5505 to replace my PIX 501. I noticed now that when I go to my public web site for the Remote Web Workplace, the browser is being told that the certificate is whacked. It seemed like the PIX 501 just passed the https request right to my SBS 2008 server and all was good, but now it looks like the 5505 is giving out a self-signed certificate before passing the traffic on to the SBS 2008 server. What do I need to do to make this all better?

ASKER CERTIFIED SOLUTION

asanewbie

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Hotwaffles

Not sure why it listed that comment as expert because this is my expert account... oh well

It is because the ASA uses a self signed certificate for its web interface.

to correct this simply disable the outside pdm access by typing

no https x.x.x.x x.x.x.x outside

you need to find what it has in place already by doing a show run and looking for the lines that look like this:

http server enable
http 0.0.0.0 0.0.0.0 inside
http x.x.x.0 255.255.248.0 outside <----- remove this entry

or if you want to keep PDM access from the outside you will need to get another public IP

Ken Fayal

ASKER

I have this in my show conf

http server enable
http 172.28.16.0 255.255.255.0 inside

I don't have any reference to http on the outside interface. Could it be something else?

Hotwaffles

you may have to disable the https server completely if you only have one public ip.

config t
no http 172.28.16.0 255.255.255.0 inside
no http server enable

Ken Fayal

ASKER

Here's my whole configuration modified to hide real information

hostname rdifw
domain-name mydomain.com
enable password xxxxxxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxxxx encrypted
names
name 172.28.16.2 EAGLE-SVR
name 172.28.16.3 FALCON
name xxx.xxx.xxx.xxx host1.mydomain.com
name xxx.xxx.xxx.xxx host2.mydomain.com
!
interface Vlan1
nameif inside
security-level 100
ip address 172.28.16.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address host1.mydomain.com 255.255.255.240
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name mydomain.com
access-list outside_access_in_1 extended permit tcp any host host1.mydomain.com eq smtp
access-list outside_access_in_1 extended permit tcp any host host1.mydomain.com eq www
access-list outside_access_in_1 extended permit tcp any host host1.mydomain.com eq https
access-list outside_access_in_1 extended permit tcp any host host2.mydomain.com eq https
access-list outside_access_in_1 extended permit tcp any host host2.mydomain.com eq www
access-list outside_access_in_1 extended permit tcp any host host1.mydomain.com eq 987
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
asdm location host1.mydomain.com 255.255.255.255 inside
asdm location host2.mydomain.com 255.255.255.255 inside
asdm location FALCON 255.255.255.255 inside
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) interface EAGLE-SVR netmask 255.255.255.255
static (inside,outside) host2.mydomain.com FALCON netmask 255.255.255.255
access-group outside_access_in_1 in interface outside
route outside 0.0.0.0 0.0.0.0 70.166.5.65 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 172.28.16.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context

Hotwaffles

well everything seems ok, the next question would be. If you choose to view the certificate that your web browser says isn't trusted who is the issuing authority? Basically, what certificate is it from.

Ken Fayal

ASKER

I found out that somehow my SBS 2008 server switched to using a self-signed cert instead of my CA certificate in the IIS bindings. I don't know how that happened, but your questions to me about who is issuing the cert led me to the answer so you get full points.