How to solve the issue between ASDM and SSL connection with one JAVA in ASA?

eemoon
eemoon used Ask the Experts™
on
HI Expert, it took some time for me to configure SSL vpn connection successfully. The reason is that I changed java version from 6 to 7. However after I changed it to 7, ASDM cannot work under the version 7. If I change back to version6, SSL vpn connection will be down. How to solve the issue ? Thank you
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Network Administrator
Commented:
Not sure how the java version affects the VPN tunnell and won't mind if you can explain that.
Naturally, java just provides a platform to connect ASDM to the firewall and is not part of the IOS. Moreso, VPN tunnell has nothing to do with java.

With that said, you may need to change the security level on your java to allow ASMD to work

Also, add the url of the ASA to the approved sites
Lastly, import the certificate from the ASA into the trusted sites in java

For version 7
- go to control panel, open java, navigate to the security tab, then lower the security to medium. Option to lower security is not available in version 8 so that requires the 2nd option below
Version 7aVersion 7Alternatively, add the url of the ASA to the site list in addition to import the ASA certificate into the trusted site list
This is your only option for version 8
Version  8aVersion  8bVersion  8c
Top Expert 2014
Commented:
Just use compatibility mode in your browser.
btanExec Consultant
Distinguished Expert 2018

Commented:
remember to import the Cisco certificate, see further steps in link
When using some versions of Java, such as Version 7 update 51, the ASDM Launcher requires a trusted certificate. An easy approach to fulfill the certificate requirements is to generate a self-signed identity certificate and to configure the ASA to use it when establishing an SSL connection. After you generate the identity certificate and configure the ASA, you need to register it with the Java Control Panel on your computer.

For the ASA 5506-X, 5508-X, or 5516-X with an ASA FirePOWER module, you can use ASDM for module management. In this case, you must create two identity certificates: one for the ASA and one for the module.
http://www.cisco.com/c/en/us/td/docs/security/asdm/identity-cert/cert-install.html
More on the workarounds in ADSM 7.1(x) release notes - http://www.cisco.com/c/en/us/td/docs/security/asdm/7_1/release/notes/rn71.html#wp516584

also as same machine may be used to manage multiple ASA and the browser cache itself may trigger the issue, so In Java Control Panel's General tab sheet, there is the Temporary Internet Files. Typically removing all temp files will result in better functionality.

Author

Commented:
After downgrading to java6 and did some config based on what you said, ASDM begin to work. the client already is installed there. So just clicked it. It can work now. Thank you!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial