2

After upgrading a Cisco ASA to code version 9.12(1)3, I am unable to reach the HTTPS management interface, which we use for many automation tools.

Example curl that is functional in prior code (9.8 or 9.10):

curl -k -u mah_user https://10.10.10.1/admin/exec/show+version

Now, instead of the output of that command, we are receiving a 400 Bad Request error.

What changed?

3

As of ASA code 9.12, you must provide a user-agent header with your HTTP requests to the ASA management interface.

In the ASA code version 9.12 release notes, it specifies the following:

Allow non-browser-based HTTPS clients to access the ASA

You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed.

New/Modified commands: http server basic-auth-client

What they do not explicitly spell out in this output, is that the ASA management "API" was not previously a supported way to access the ASA. It was intended to be used by the ASDM or their own REST API wrapper.

In opening it up for "the rest of us" and making it supported behavior (which they needed to do because there is no ASA REST API java applet on the ASA code running on Firepower hardware), they added some new restrictions.

You can either do one of the following:

  1. Add user-agent headers with a value you specify in http server basic-auth-client <my-user-agent-goes-here>

    • Example config: http server basic-auth-client mah_user_agent
    • Example curl: curl -k -u mah_user -A mah_user_agent https://10.10.10.1/admin/exec/show+version
  2. Use one of the pre-existing/supported user-agent headers:

    • Example curl: curl -k -u mah_user -A ASDM https://10.10.10.1/admin/exec/show+version

Either one of these will work for you, although I prefer the second as it needs no config changes on the ASA to function.

It is also worth noting, that in my testing you can also send the user-agent: ASDM header with all prior versions of ASA code as well, they just don't care what you send or set for that value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.