2

ASA 5540 VPN Premium license. Version 9.1(7)

asa01(config)# crypto key generate rsa label sslvpnkey                             
                      ^                                                         
ERROR: % Invalid input detected at '^' marker.

It seems I'm missing options for crypto:

asa01(config)# crypto ?

configure mode commands/options:
  engine  Configure crypto engine
  isakmp  Configure ISAKMP

sh ver output:

Cisco Adaptive Security Appliance Software Version 9.1(7) <system>

Compiled on Thu 14-Jan-16 09:37 by builders
System image file is "disk0:/asa917-k8.bin"
Config file at boot was "startup-config"

asa01 up 9 mins 24 secs

Hardware:   ASA5540, 2048 MB RAM, CPU Pentium 4 2000 MHz,
Internal ATA Compact Flash, 256MB
BIOS Flash M50FW080 @ 0xfff00000, 1024KB

Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x0)
                             Boot microcode        : CN1000-MC-BOOT-2.00 
                             SSL/IKE microcode     : CNlite-MC-SSLm-PLUS-2.08
                             IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.09
                             Number of accelerators: 1

 0: Ext: GigabitEthernet0/0  : address is 0025.45d7.883a, irq 9
 1: Ext: GigabitEthernet0/1  : address is 0025.45d7.883b, irq 9
 2: Ext: GigabitEthernet0/2  : address is 0025.45d7.883c, irq 9
 3: Ext: GigabitEthernet0/3  : address is 0025.45d7.883d, irq 9
 4: Ext: Management0/0       : address is 0025.45d7.883e, irq 11
 5: Int: Not used            : irq 11
 6: Int: Not used            : irq 5

Licensed features for this platform:
Maximum Physical Interfaces       : Unlimited      perpetual
Maximum VLANs                     : 200            perpetual
Inside Hosts                      : Unlimited      perpetual
Failover                          : Active/Active  perpetual
Encryption-DES                    : Enabled        perpetual
Encryption-3DES-AES               : Enabled        perpetual
Security Contexts                 : 2              perpetual
GTP/GPRS                          : Disabled       perpetual
AnyConnect Premium Peers          : 2              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 5000           perpetual
Total VPN Peers                   : 5000           perpetual
Shared License                    : Disabled       perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
UC Phone Proxy Sessions           : 2              perpetual
Total UC Proxy Sessions           : 2              perpetual
Botnet Traffic Filter             : Disabled       perpetual
Intercompany Media Engine         : Disabled       perpetual
Cluster                           : Enabled        perpetual

This platform has an ASA 5540 VPN Premium license.

Serial Number: ***********
Running Permanent Activation Key: ********** ********** ********** ********** ********** 
Configuration register is 0x1
Configuration has not been modified since last system restart.

UPDATE: I was in multi-context mode, after switching to single context, webvpn command is now recognized (with only the remove option) and crypto now only has the ca option.

Why am I missing options?

Improve this question
5
  • Did it work before you installed the firmware update? – Michael Hampton Oct 21 '18 at 19:20
  • @MichaelHampton No – Don P Oct 21 '18 at 19:23
  • Possible duplicate of Missing crypto command options for Cisco 5540 Firewall? – kaiser Oct 21 '18 at 21:35
  • see update, I'm now in single context but with only the ca option. – Don P Oct 22 '18 at 0:03
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin♦ Dec 25 '18 at 9:50
2

Cisco Adaptive Security Appliance Software Version 9.1(7) <system>

As I asked on your previous NE question, you're running in multiple context mode. The "<system>" at the end of the version line is the dead giveaway. You cannot set RSA keys from the system context. You need to be in a specific context -- or turn multiple context mode off.

Improve this answer
1
  • please see update comment at bottom of post, i'll update the sh ver output when I get a chance, <system> indicator is gone, in single context mode. – Don P Oct 22 '18 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.