2

After upgrading a Cisco ASA to code version 9.12(1)3, I am unable to reach the HTTPS management interface, which we use for many automation tools.

Example curl that is functional in prior code (9.8 or 9.10):

curl -k -u mah_user https://10.10.10.1/admin/exec/show+version

Now, instead of the output of that command, we are receiving a 400 Bad Request error.

What changed?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 3:02
  • Accepted! Sorry I forgot to do that previously! – Brett Lykins Dec 15 '19 at 17:00
  • No problem. I'm just doing the year-end cleanup where I remind people of such things. It tends to gain people a "year-end bonus" when answers start getting accepted. – Ron Maupin Dec 15 '19 at 17:59
4

As of ASA code 9.12, you must provide a user-agent header with your HTTP requests to the ASA management interface.

In the ASA code version 9.12 release notes, it specifies the following:

Allow non-browser-based HTTPS clients to access the ASA

You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed.

New/Modified commands: http server basic-auth-client

What they do not explicitly spell out in this output, is that the ASA management "API" was not previously a supported way to access the ASA. It was intended to be used by the ASDM or their own REST API wrapper.

In opening it up for "the rest of us" and making it supported behavior (which they needed to do because there is no ASA REST API java applet on the ASA code running on Firepower hardware), they added some new restrictions.

You can either do one of the following:

  1. Add user-agent headers with a value you specify in http server basic-auth-client <my-user-agent-goes-here>

    • Example config: http server basic-auth-client mah_user_agent
    • Example curl: curl -k -u mah_user -A mah_user_agent https://10.10.10.1/admin/exec/show+version
  2. Use one of the pre-existing/supported user-agent headers:

    • Example curl: curl -k -u mah_user -A ASDM https://10.10.10.1/admin/exec/show+version

Either one of these will work for you, although I prefer the second as it needs no config changes on the ASA to function.

It is also worth noting, that in my testing you can also send the user-agent: ASDM header with all prior versions of ASA code as well, they just don't care what you send or set for that value.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.