ASA Configuration Troubleshooting - Revision history

Ssrimuru: /* Enable Auto-update server Logging on ASA Device */

2011-06-02T10:10:25Z

Enable Auto-update server Logging on ASA Device

← Older revision		Revision as of 10:10, 2 June 2011
Line 31:		Line 31:
	Make sure to add the appropriate name <ce-server-ip-address> <ce-server-hostname> command. As a work around you can use the IP address of the CE server in the '''auto-update server''' command instead of hostname.		Make sure to add the appropriate name <ce-server-ip-address> <ce-server-hostname> command. As a work around you can use the IP address of the CE server in the '''auto-update server''' command instead of hostname.

-	==Enable Auto-update ~~server~~ Logging on ASA Device==	+	==Enable Auto-update Server Logging on ASA Device==

	To enable auto-update server logging on ASA device, execute the following commands:		To enable auto-update server logging on ASA device, execute the following commands:

Ssrimuru: /* Configuration not pulled due to java.lang.SecurityException: Device Authentication Failed */

2011-06-02T10:09:55Z

Configuration not pulled due to java.lang.SecurityException: Device Authentication Failed

← Older revision		Revision as of 10:09, 2 June 2011
Line 43:		Line 43:
	ASA-Device# '''debug auto-update client'''		ASA-Device# '''debug auto-update client'''

-	== ~~Configuration not pulled due to java.lang.SecurityException:~~ Device Authentication Failed ==	+	== Device Authentication Failed ==
	When you get this error message, check the following:		When you get this error message, check the following:

Ssrimuru: /* Configuration Not Pulled */

2011-06-02T10:08:57Z

Configuration Not Pulled

← Older revision		Revision as of 10:08, 2 June 2011
Line 57:		Line 57:
	1. Enable console/terminal logging on ASA device.		1. Enable console/terminal logging on ASA device.

-	2. On elapse of poll-period ASA device will try to contact the CE server to retrieve the new template. During this time, the following log (not identical but similar) can be seen on the ASA device console.	+	2. On elapse of poll-period, ASA device will try to contact the CE server to retrieve the new template. During this time, the following log (not identical but similar) can be seen on the ASA device console.

	'''%ASA-6-302013: Built outbound TCP connection 23 for inside:cede1/443 (cede1/443) to identity:10.104.58.246/33894 (10.104.58.246/33894)'''		'''%ASA-6-302013: Built outbound TCP connection 23 for inside:cede1/443 (cede1/443) to identity:10.104.58.246/33894 (10.104.58.246/33894)'''
Line 77:		Line 77:
	'''Auto-update client: no need to update cfg'''		'''Auto-update client: no need to update cfg'''

-	3. If the logging says that '''no need to update cfg''', then the configuration associated to the ASA device on CE server and running configuration on ASA device ~~are~~ same and current.	+	3. If the logging says that '''no need to update cfg''', then the configuration associated to the ASA device on CE server and running configuration on ASA device will be the same and current.

	== Prerequisite for ASA/ASDM Image Upgrade ==		== Prerequisite for ASA/ASDM Image Upgrade ==

Ssrimuru: /* Prerequisite for ASA/ASDM Image Upgrade */

2011-06-02T10:07:35Z

Prerequisite for ASA/ASDM Image Upgrade

← Older revision		Revision as of 10:07, 2 June 2011
Line 83:		Line 83:
	Along with auto-update server configuration, following CLI should exist on the ASA device for the ASA/ASDM image upgrade to happen.		Along with auto-update server configuration, following CLI should exist on the ASA device for the ASA/ASDM image upgrade to happen.

-	boot system disk0:/<a-valid-asa-image-name>	+	'''boot system disk0:/<a-valid-asa-image-name>'''

-	asdm image disk0:/<a-valid-asdm-image-name>	+	'''asdm image disk0:/<a-valid-asdm-image-name>'''

-	Without these two ~~CLIs~~, neither the ASA image or ASDM image upgrade will happen.	+	Without these two Commands, neither the ASA image or ASDM image upgrade will happen.

	== ASA/ASDM Image Upgrade Fails ==		== ASA/ASDM Image Upgrade Fails ==

Ssrimuru: /* ASA/ASDM image upgrade know issues */

2011-06-02T10:06:29Z

ASA/ASDM image upgrade know issues

← Older revision		Revision as of 10:06, 2 June 2011
Line 93:		Line 93:
	This failure could cause because of having not enough space on the flash card on the ASA device. Make sure that the flash have enough space on the device before performing the image upgrade operation.		This failure could cause because of having not enough space on the flash card on the ASA device. Make sure that the flash have enough space on the device before performing the image upgrade operation.

-	== ASA/ASDM ~~image upgrade know issues~~ ==	+	== ASA/ASDM Image Upgrade Know Issues ==
	Following are the known issues at this point which might impact the ASA/ASDM image upgrade on ASA devices.		Following are the known issues at this point which might impact the ASA/ASDM image upgrade on ASA devices.

Ssrimuru: /* ASA/ASDM image upgrade fails with error "could not open flash" */

2011-06-02T10:06:02Z

ASA/ASDM image upgrade fails with error "could not open flash"

← Older revision		Revision as of 10:06, 2 June 2011
Line 89:		Line 89:
	Without these two CLIs, neither the ASA image or ASDM image upgrade will happen.		Without these two CLIs, neither the ASA image or ASDM image upgrade will happen.

-	== ASA/ASDM ~~image upgrade fails with error "could not open flash"~~ ==	+	== ASA/ASDM Image Upgrade Fails ==

	This failure could cause because of having not enough space on the flash card on the ASA device. Make sure that the flash have enough space on the device before performing the image upgrade operation.		This failure could cause because of having not enough space on the flash card on the ASA device. Make sure that the flash have enough space on the device before performing the image upgrade operation.

Ssrimuru: /* Prerequisite for ASA/ASDM image upgrade */

2011-06-02T10:05:03Z

Prerequisite for ASA/ASDM image upgrade

← Older revision		Revision as of 10:05, 2 June 2011
Line 79:		Line 79:
	3. If the logging says that '''no need to update cfg''', then the configuration associated to the ASA device on CE server and running configuration on ASA device are same and current.		3. If the logging says that '''no need to update cfg''', then the configuration associated to the ASA device on CE server and running configuration on ASA device are same and current.

-	== Prerequisite for ASA/ASDM ~~image upgrade~~ ==	+	== Prerequisite for ASA/ASDM Image Upgrade ==

	Along with auto-update server configuration, following CLI should exist on the ASA device for the ASA/ASDM image upgrade to happen.		Along with auto-update server configuration, following CLI should exist on the ASA device for the ASA/ASDM image upgrade to happen.

Ssrimuru: /* Configuration not pulled */

2011-06-02T10:04:42Z

Configuration not pulled

← Older revision		Revision as of 10:04, 2 June 2011
Line 52:		Line 52:
	3. If you feel that the password is incorrect on either side, then re-sync the password on both the side by reconfiguring the auto-update server CLI on ASA device and by editing the device on CE side.		3. If you feel that the password is incorrect on either side, then re-sync the password on both the side by reconfiguring the auto-update server CLI on ASA device and by editing the device on CE side.

-	== Configuration ~~not pulled~~ ==	+	== Configuration Not Pulled ==
-	This is because the device already downloaded associated template from CE server and the ASA device is running with updated configuration. Do the following to verify this.	+	This is because the device already downloaded associated template from CE server and the ASA device is running with updated configuration. Do the following to verify this:

	1. Enable console/terminal logging on ASA device.		1. Enable console/terminal logging on ASA device.

Ssrimuru: /* Enable auto-update server logging on ASA device */

2011-06-02T10:03:51Z

Enable auto-update server logging on ASA device

← Older revision		Revision as of 10:03, 2 June 2011
Line 31:		Line 31:
	Make sure to add the appropriate name <ce-server-ip-address> <ce-server-hostname> command. As a work around you can use the IP address of the CE server in the '''auto-update server''' command instead of hostname.		Make sure to add the appropriate name <ce-server-ip-address> <ce-server-hostname> command. As a work around you can use the IP address of the CE server in the '''auto-update server''' command instead of hostname.

-	==Enable ~~auto~~-update server ~~logging~~ on ASA ~~device~~==	+	==Enable Auto-update server Logging on ASA Device==

	To enable auto-update server logging on ASA device, execute the following commands:		To enable auto-update server logging on ASA device, execute the following commands:

Ssrimuru: /* Configuring the ASA device */

2011-06-02T10:03:26Z

Configuring the ASA device

← Older revision		Revision as of 10:03, 2 June 2011
Line 7:		Line 7:
	The ASA server related logs on CE server can be found @ /var/log/CNSCE/asa/asa.log. The ASA device supports IOS version 8.2 onwards.		The ASA server related logs on CE server can be found @ /var/log/CNSCE/asa/asa.log. The ASA device supports IOS version 8.2 onwards.

-	==Configuring the ASA ~~device~~==	+	==Configuring the ASA Device==
	The following commands should be configured on ASA device to communicate with CE server to work using the call home protocol.		The following commands should be configured on ASA device to communicate with CE server to work using the call home protocol.