1

Heyho,

I got a problem after ASA Update to 9.1 with the authentication on the ASA web portal with RSA Token.

Before the we were on ASA 8.4 and everything was fine. A new token was assigned to a co-worker. Then on first logon her had only to insert username (AD) and the passcode from his token. He then was prompted to enter a new PIN and to verify this PIN. After that he had to enter the PIN + next token code to finish authentication. Everything was fine and he was ready to use the clientless VPN via the ASA web portal.

After the update to 9.1 (important due to serious security issues) when I want to make the initial authentication for a new co-worker, he enters the username + passcode, then gets prompted for the new PIN, BUT Top of the login window is written: "Enter a new PIN between 4 and 8 alphanumeric characters:" and below there are not the two lines for the new PIN, but again the prompt for username + passcode.

So I'm not able to do the inital authentication.

I did a lot of research the last two days, but did not find anything which describs my problem.

Also in addition I am fairly new to the asa web portal thing. A former co-worker configured it years ago and I only had to do the token assignment and everything was fine until the update to 9.1

Had maybe someone encountered such a problem and could give me a hint?

If you need some information, just tell me what and I'll try to provide them.

Improve this question
2
  • what is the exact ASA software version? E.g. 9.1(3) or 9.1(4.15) – hertitu Oct 28 '16 at 10:39
  • 9.1(7)9 ist the current version, its an asa 5520, but that should not really matter, should it? – Fraggles Oct 28 '16 at 11:38
2

You are hitting the following bug:

CSCva87160 OTP authentication is not working for clientless ssl vpn (Cisco login required)

If you want to stay on 9.1, you can go to 9.1(7.11), otherwise you have a choice of fixed releases:

9.1(7.11)
9.2(4.17)
9.4(3.12)
9.5(3.2)
9.6(2.1)

But note that since this is a relatively recent bugfix, not all of the above versions are available yet at this time.

Improve this answer
5
  • hm... i have no cisco account, so i cant really see the details for this bugreport, but it looks like the problem I encountered – Fraggles Oct 28 '16 at 12:18
  • then how did you upgrade the ASA? You need an account to download the software? Anyway, I think I'm legally not allowed to copy the bug details here, but I hope it's safe to say that the key point of the bug is After the first authentication, not the second OPT authentication screen is displayed but the first one is displayed. so this seems to match 100% what you are saying. The bug does affect 9.1(7)9 and I've already mentioned the fixed versions. – hertitu Oct 28 '16 at 12:21
  • my co-worker did the upgrade, so he should have an account :) I'll ask him – Fraggles Oct 28 '16 at 12:42
  • Made an account for myself, and yes, this is exactly my Problem only with RSA. But I think its the same bug. But thanks for your help :) – Fraggles Oct 28 '16 at 13:04
  • 1
    Well yes the bug mentions two-factor auth, probably because it was reported by a customer doing OTP as one of the 2 factors, but the bug is clearly in the OTP part so will occur just as well with single-factor auth. (BTW OTP=one-time-password, so this matches RSA, just in case that was not clear) – hertitu Oct 28 '16 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.