I got a problem after ASA Update to 9.1 with the authentication on the ASA web portal with RSA Token.

Before the we were on ASA 8.4 and everything was fine. A new token was assigned to a co-worker. Then on first logon her had only to insert username (AD) and the passcode from his token. He then was prompted to enter a new PIN and to verify this PIN. After that he had to enter the PIN + next token code to finish authentication. Everything was fine and he was ready to use the clientless VPN via the ASA web portal.

After the update to 9.1 (important due to serious security issues) when I want to make the initial authentication for a new co-worker, he enters the username + passcode, then gets prompted for the new PIN, BUT Top of the login window is written: "Enter a new PIN between 4 and 8 alphanumeric characters:" and below there are not the two lines for the new PIN, but again the prompt for username + passcode.

So I'm not able to do the inital authentication.

I did a lot of research the last two days, but did not find anything which describs my problem.

Also in addition I am fairly new to the asa web portal thing. A former co-worker configured it years ago and I only had to do the token assignment and everything was fine until the update to 9.1

Had maybe someone encountered such a problem and could give me a hint?

If you need some information, just tell me what and I'll try to provide them.

  • what is the exact ASA software version? E.g. 9.1(3) or 9.1(4.15)
    – hertitu
    Commented Oct 28, 2016 at 10:39
  • 9.1(7)9 ist the current version, its an asa 5520, but that should not really matter, should it?
    – Fraggles
    Commented Oct 28, 2016 at 11:38

1 Answer 1


You are hitting the following bug:

CSCva87160 OTP authentication is not working for clientless ssl vpn (Cisco login required)

If you want to stay on 9.1, you can go to 9.1(7.11), otherwise you have a choice of fixed releases:


But note that since this is a relatively recent bugfix, not all of the above versions are available yet at this time.

  • hm... i have no cisco account, so i cant really see the details for this bugreport, but it looks like the problem I encountered
    – Fraggles
    Commented Oct 28, 2016 at 12:18
  • then how did you upgrade the ASA? You need an account to download the software? Anyway, I think I'm legally not allowed to copy the bug details here, but I hope it's safe to say that the key point of the bug is After the first authentication, not the second OPT authentication screen is displayed but the first one is displayed. so this seems to match 100% what you are saying. The bug does affect 9.1(7)9 and I've already mentioned the fixed versions.
    – hertitu
    Commented Oct 28, 2016 at 12:21
  • my co-worker did the upgrade, so he should have an account :) I'll ask him
    – Fraggles
    Commented Oct 28, 2016 at 12:42
  • Made an account for myself, and yes, this is exactly my Problem only with RSA. But I think its the same bug. But thanks for your help :)
    – Fraggles
    Commented Oct 28, 2016 at 13:04
  • 1
    Well yes the bug mentions two-factor auth, probably because it was reported by a customer doing OTP as one of the 2 factors, but the bug is clearly in the OTP part so will occur just as well with single-factor auth. (BTW OTP=one-time-password, so this matches RSA, just in case that was not clear)
    – hertitu
    Commented Oct 28, 2016 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.