Unable to use HTTPS Managment “API” on Cisco ASA 9.12Cisco ASA ACL helphttps url filtering on Cisco ASA 5520Unable to save ASA configSSD status on Cisco ASAASA unable to pass ICMP and RDP through internal interfacesASA / WCCP issue with https service group 70Unable to properly configure ASA 5512 with WAN IPUnable to reach public IPs of servers behind ASA 5512Oxidized Unable to Pull Cisco ASA ConfigCisco ASA rekeying
What's the most polite way to tell a manager "shut up and let me work"?
If a massive object like Jupiter flew past the Earth how close would it need to come to pull people off of the surface?
What should I do about a religious player who refuses to accept the existence of multiple gods in D&D?
California: "For quality assurance, this phone call is being recorded"
Is there a term for this?
Select row of data if next row contains zero
Recording the inputs of a command and producing a list of them later on
The deliberate use of misleading terminology
Is there a rule that prohibits us from using 2 possessives in a row?
Are grass strips more dangerous than tarmac?
Is having a hidden directory under /etc safe?
What does it mean by "d-ism of Leibniz" and "dotage of Newton" in simple English?
How crucial is a waifu game storyline?
Is the world in Game of Thrones spherical or flat?
TV show or movie: Diseased people are exiled to a spaceship
What does War Machine's "Canopy! Canopy!" line mean in "Avengers: Endgame"?
Why is Colorado so different politically from nearby states?
Why would Lupin kill Pettigrew?
How do I truncate a csv file?
How can I offer a test ride while selling a bike?
Explain Ant-Man's "not it" scene from Avengers: Endgame
How much current can Baofeng UV-5R provide on +V pin?
What is the right way to float a home lab?
Coding Challenge Solution - Good Range
Unable to use HTTPS Managment “API” on Cisco ASA 9.12
Cisco ASA ACL helphttps url filtering on Cisco ASA 5520Unable to save ASA configSSD status on Cisco ASAASA unable to pass ICMP and RDP through internal interfacesASA / WCCP issue with https service group 70Unable to properly configure ASA 5512 with WAN IPUnable to reach public IPs of servers behind ASA 5512Oxidized Unable to Pull Cisco ASA ConfigCisco ASA rekeying
After upgrading a Cisco ASA to code version 9.12(1)3, I am unable to reach the HTTPS management interface, which we use for many automation tools.
Example curl that is functional in prior code (9.8 or 9.10):
curl -k -u mah_user https://10.10.10.1/admin/exec/show+version
Now, instead of the output of that command, we are receiving a 400 Bad Request error.
What changed?
cisco cisco-asa api
asked May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
add a comment |
After upgrading a Cisco ASA to code version 9.12(1)3, I am unable to reach the HTTPS management interface, which we use for many automation tools.
Example curl that is functional in prior code (9.8 or 9.10):
curl -k -u mah_user https://10.10.10.1/admin/exec/show+version
Now, instead of the output of that command, we are receiving a 400 Bad Request error.
What changed?
cisco cisco-asa api
asked May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
add a comment |
After upgrading a Cisco ASA to code version 9.12(1)3, I am unable to reach the HTTPS management interface, which we use for many automation tools.
Example curl that is functional in prior code (9.8 or 9.10):
curl -k -u mah_user https://10.10.10.1/admin/exec/show+version
Now, instead of the output of that command, we are receiving a 400 Bad Request error.
What changed?
cisco cisco-asa api
asked May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
After upgrading a Cisco ASA to code version 9.12(1)3, I am unable to reach the HTTPS management interface, which we use for many automation tools.
Example curl that is functional in prior code (9.8 or 9.10):
curl -k -u mah_user https://10.10.10.1/admin/exec/show+version
Now, instead of the output of that command, we are receiving a 400 Bad Request error.
What changed?
cisco cisco-asa api
cisco cisco-asa api
asked May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
asked May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
asked May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
asked May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
asked May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
7,44352964
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
As of ASA code 9.12, you must provide a user-agent header with your HTTP requests to the ASA management interface.
In the ASA code version 9.12 release notes, it specifies the following:
Allow non-browser-based HTTPS clients to access the ASA
You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed.
New/Modified commands: http server basic-auth-client
What they do not explicitly spell out in this output, is that the ASA management "API" was not previously a supported way to access the ASA. It was intended to be used by the ASDM or their own REST API wrapper.
In opening it up for "the rest of us" and making it supported behavior (which they needed to do because there is no ASA REST API java applet on the ASA code running on Firepower hardware), they added some new restrictions.
You can either do one of the following:
Add
user-agentheaders with a value you specify inhttp server basic-auth-client <my-user-agent-goes-here>- Example config:
http server basic-auth-client mah_user_agent - Example curl:
curl -k -u mah_user -A mah_user_agent https://10.10.10.1/admin/exec/show+version
- Example config:
Use one of the pre-existing/supported
user-agentheaders:- Example curl:
curl -k -u mah_user -A ASDM https://10.10.10.1/admin/exec/show+version
- Example curl:
Either one of these will work for you, although I prefer the second as it needs no config changes on the ASA to function.
It is also worth noting, that in my testing you can also send the user-agent: ASDM header with all prior versions of ASA code as well, they just don't care what you send or set for that value.
answered May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "496"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f59366%2funable-to-use-https-managment-api-on-cisco-asa-9-12%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
As of ASA code 9.12, you must provide a user-agent header with your HTTP requests to the ASA management interface.
In the ASA code version 9.12 release notes, it specifies the following:
Allow non-browser-based HTTPS clients to access the ASA
You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed.
New/Modified commands: http server basic-auth-client
What they do not explicitly spell out in this output, is that the ASA management "API" was not previously a supported way to access the ASA. It was intended to be used by the ASDM or their own REST API wrapper.
In opening it up for "the rest of us" and making it supported behavior (which they needed to do because there is no ASA REST API java applet on the ASA code running on Firepower hardware), they added some new restrictions.
You can either do one of the following:
Add
user-agentheaders with a value you specify inhttp server basic-auth-client <my-user-agent-goes-here>- Example config:
http server basic-auth-client mah_user_agent - Example curl:
curl -k -u mah_user -A mah_user_agent https://10.10.10.1/admin/exec/show+version
- Example config:
Use one of the pre-existing/supported
user-agentheaders:- Example curl:
curl -k -u mah_user -A ASDM https://10.10.10.1/admin/exec/show+version
- Example curl:
Either one of these will work for you, although I prefer the second as it needs no config changes on the ASA to function.
It is also worth noting, that in my testing you can also send the user-agent: ASDM header with all prior versions of ASA code as well, they just don't care what you send or set for that value.
answered May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
add a comment |
As of ASA code 9.12, you must provide a user-agent header with your HTTP requests to the ASA management interface.
In the ASA code version 9.12 release notes, it specifies the following:
Allow non-browser-based HTTPS clients to access the ASA
You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed.
New/Modified commands: http server basic-auth-client
What they do not explicitly spell out in this output, is that the ASA management "API" was not previously a supported way to access the ASA. It was intended to be used by the ASDM or their own REST API wrapper.
In opening it up for "the rest of us" and making it supported behavior (which they needed to do because there is no ASA REST API java applet on the ASA code running on Firepower hardware), they added some new restrictions.
You can either do one of the following:
Add
user-agentheaders with a value you specify inhttp server basic-auth-client <my-user-agent-goes-here>- Example config:
http server basic-auth-client mah_user_agent - Example curl:
curl -k -u mah_user -A mah_user_agent https://10.10.10.1/admin/exec/show+version
- Example config:
Use one of the pre-existing/supported
user-agentheaders:- Example curl:
curl -k -u mah_user -A ASDM https://10.10.10.1/admin/exec/show+version
- Example curl:
Either one of these will work for you, although I prefer the second as it needs no config changes on the ASA to function.
It is also worth noting, that in my testing you can also send the user-agent: ASDM header with all prior versions of ASA code as well, they just don't care what you send or set for that value.
answered May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
add a comment |
As of ASA code 9.12, you must provide a user-agent header with your HTTP requests to the ASA management interface.
In the ASA code version 9.12 release notes, it specifies the following:
Allow non-browser-based HTTPS clients to access the ASA
You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed.
New/Modified commands: http server basic-auth-client
What they do not explicitly spell out in this output, is that the ASA management "API" was not previously a supported way to access the ASA. It was intended to be used by the ASDM or their own REST API wrapper.
In opening it up for "the rest of us" and making it supported behavior (which they needed to do because there is no ASA REST API java applet on the ASA code running on Firepower hardware), they added some new restrictions.
You can either do one of the following:
Add
user-agentheaders with a value you specify inhttp server basic-auth-client <my-user-agent-goes-here>- Example config:
http server basic-auth-client mah_user_agent - Example curl:
curl -k -u mah_user -A mah_user_agent https://10.10.10.1/admin/exec/show+version
- Example config:
Use one of the pre-existing/supported
user-agentheaders:- Example curl:
curl -k -u mah_user -A ASDM https://10.10.10.1/admin/exec/show+version
- Example curl:
Either one of these will work for you, although I prefer the second as it needs no config changes on the ASA to function.
It is also worth noting, that in my testing you can also send the user-agent: ASDM header with all prior versions of ASA code as well, they just don't care what you send or set for that value.
answered May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
As of ASA code 9.12, you must provide a user-agent header with your HTTP requests to the ASA management interface.
In the ASA code version 9.12 release notes, it specifies the following:
Allow non-browser-based HTTPS clients to access the ASA
You can allow non-browser-based HTTPS clients to access HTTPS services on the ASA. By default, ASDM, CSM, and REST API are allowed.
New/Modified commands: http server basic-auth-client
What they do not explicitly spell out in this output, is that the ASA management "API" was not previously a supported way to access the ASA. It was intended to be used by the ASDM or their own REST API wrapper.
In opening it up for "the rest of us" and making it supported behavior (which they needed to do because there is no ASA REST API java applet on the ASA code running on Firepower hardware), they added some new restrictions.
You can either do one of the following:
Add
user-agentheaders with a value you specify inhttp server basic-auth-client <my-user-agent-goes-here>- Example config:
http server basic-auth-client mah_user_agent - Example curl:
curl -k -u mah_user -A mah_user_agent https://10.10.10.1/admin/exec/show+version
- Example config:
Use one of the pre-existing/supported
user-agentheaders:- Example curl:
curl -k -u mah_user -A ASDM https://10.10.10.1/admin/exec/show+version
- Example curl:
Either one of these will work for you, although I prefer the second as it needs no config changes on the ASA to function.
It is also worth noting, that in my testing you can also send the user-agent: ASDM header with all prior versions of ASA code as well, they just don't care what you send or set for that value.
answered May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
answered May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
answered May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
answered May 24 at 1:55
Brett LykinsBrett Lykins
7,44352964
7,44352964
add a comment |
add a comment |
Thanks for contributing an answer to Network Engineering Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fnetworkengineering.stackexchange.com%2fquestions%2f59366%2funable-to-use-https-managment-api-on-cisco-asa-9-12%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
