As of ASA code 9.12, you must provide a
user-agent header with your HTTP requests to the ASA management interface.
In the ASA code version 9.12 release notes, it specifies the following:
Allow non-browser-based HTTPS clients to access the ASA
You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed.
New/Modified commands: http server basic-auth-client
What they do not explicitly spell out in this output, is that the ASA management "API" was not previously a supported way to access the ASA. It was intended to be used by the ASDM or their own REST API wrapper.
In opening it up for "the rest of us" and making it supported behavior (which they needed to do because there is no ASA REST API java applet on the ASA code running on Firepower hardware), they added some new restrictions.
You can either do one of the following:
user-agent headers with a value you specify in
http server basic-auth-client <my-user-agent-goes-here>
- Example config:
http server basic-auth-client mah_user_agent
- Example curl:
curl -k -u mah_user -A mah_user_agent https://10.10.10.1/admin/exec/show+version
Use one of the pre-existing/supported
- Example curl:
curl -k -u mah_user -A ASDM https://10.10.10.1/admin/exec/show+version
Either one of these will work for you, although I prefer the second as it needs no config changes on the ASA to function.
It is also worth noting, that in my testing you can also send the
user-agent: ASDM header with all prior versions of ASA code as well, they just don't care what you send or set for that value.