ASDM Won't connect to 5505

Question

Disclaimer: Self learning, new to ASA.
I setup the ASA 5505 (everything via the ASDM) and got it connected and working fine.  
Set route so the inside could get to the outside
Added an object, nat rule, and ACL to allow tcp/3389 through to Server-01.  
Created objects for all the devices I wanted to have internet access, and created ACLs permitting them access.  
Fat fingered the cable modem's cable so I had to reload the ASA
I'm not sure if I clicked on something else, because on a reload I get the warning:
..WARNING: All traffic destined to the IP address of the outside interface is being redirected.
WARNING: Users will not be able to access any service enabled on the outside interface.
*** Output from config line 133, "static (inside,outside) ..."
Now, from what I can tell, everything works; internal computers have access to internet, and I can remote in using tcp/3389.  I have access to the CLI through the com cable, however, I can no longer connect to the ASA using the ASDM.
I "think" the problem is with the command "static (inside,outside) interface Server-01 netmask 255.255.255.255" but I'm not for certain.  I've tried to research how to clear the command to no avail.
Can someone help me figure out how I borked this please?  TIA
alexandre#
*** --- START GRACEFUL SHUTDOWN ---
Shutting down isakmp
Shutting down webvpn
Shutting down File system
*** --- SHUTDOWN NOW ---
Process shutdown finished
Rebooting.....
CISCO SYSTEMS
Embedded BIOS Version 1.0(12)13 08/28/08 15:50:37.45
Low Memory: 632 KB
High Memory: 507 MB
PCI Device Table.
Bus Dev Func VendID DevID Class              Irq
 00  01  00   1022   2080  Host Bridge
 00  01  02   1022   2082  Chipset En/Decrypt 11
 00  0C  00   1148   4320  Ethernet           11
 00  0D  00   177D   0003  Network En/Decrypt 10
 00  0F  00   1022   2090  ISA Bridge
 00  0F  02   1022   2092  IDE Controller
 00  0F  03   1022   2093  Audio              10
 00  0F  04   1022   2094  Serial Bus         9
 00  0F  05   1022   2095  Serial Bus         9
Evaluating BIOS Options ...
Launch BIOS Extension to setup ROMMON
Cisco Systems ROMMON Version (1.0(12)13) #0: Thu Aug 28 15:55:27 PDT 2008
Platform ASA5505
Use BREAK or ESC to interrupt boot.
Use SPACE to begin boot immediately.
Launching BootLoader...
Default configuration file contains 1 entry.
Searching / for images to boot.
Loading /asa825-k8.bin... Booting...
Platform ASA5505
Loading...
¦dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Starting check/repair pass.
Starting verification pass.
/dev/hda1: 168 files, 30935/62014 clusters
dosfsck(/dev/hda1) returned 0
Processor memory 383561728, Reserved memory: 62914560 (DSOs: 0 + kernel: 62914560)
Total SSMs found: 0
Total NICs found: 10
88E6095 rev 2 Gigabit Ethernet @ index 09 MAC: 0000.0003.0002
88E6095 rev 2 Ethernet @ index 08 MAC: 7c69.f65c.8798
88E6095 rev 2 Ethernet @ index 07 MAC: 7c69.f65c.8797
88E6095 rev 2 Ethernet @ index 06 MAC: 7c69.f65c.8796
88E6095 rev 2 Ethernet @ index 05 MAC: 7c69.f65c.8795
88E6095 rev 2 Ethernet @ index 04 MAC: 7c69.f65c.8794
88E6095 rev 2 Ethernet @ index 03 MAC: 7c69.f65c.8793
88E6095 rev 2 Ethernet @ index 02 MAC: 7c69.f65c.8792
88E6095 rev 2 Ethernet @ index 01 MAC: 7c69.f65c.8791
y88acs06 rev16 Gigabit Ethernet @ index 00 MAC: 7c69.f65c.8799
Licensed features for this platform:
Maximum Physical Interfaces    : 8
VLANs                          : 3, DMZ Restricted
Inside Hosts                   : Unlimited
Failover                       : Disabled
VPN-DES                        : Enabled
VPN-3DES-AES                   : Enabled
SSL VPN Peers                  : 2
Total VPN Peers                : 10
Dual ISPs                      : Disabled
VLAN Trunk Ports               : 0
Shared License                 : Disabled
AnyConnect for Mobile          : Disabled
AnyConnect for Cisco VPN Phone : Disabled
AnyConnect Essentials          : Disabled
Advanced Endpoint Assessment   : Disabled
UC Phone Proxy Sessions        : 2
Total UC Proxy Sessions        : 2
Botnet Traffic Filter          : Disabled
This platform has a Base license.
Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                             Boot microcode   : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.05
Cisco Adaptive Security Appliance Software Version 8.2(5)
  ****************************** Warning *******************************
  This product contains cryptographic features and is
  subject to United States and local country laws
  governing, import, export, transfer, and use.
  Delivery of Cisco cryptographic products does not
  imply third-party authority to import, export,
  distribute, or use encryption. Importers, exporters,
  distributors and users are responsible for compliance
  with U.S. and local country laws. By using this
  product you agree to comply with applicable laws and
  regulations. If you are unable to comply with U.S.
  and local laws, return the enclosed items immediately.
  A summary of U.S. laws governing Cisco cryptographic
  products may be found at:
  http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
  If you require further assistance please contact us by
  sending email to [email protected].
  ******************************* Warning *******************************
Copyright (c) 1996-2011 by Cisco Systems, Inc.
                Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
                Cisco Systems, Inc.
                170 West Tasman Drive
                San Jose, California 95134-1706
..WARNING: All traffic destined to the IP address of the outside interface is being redirected.
WARNING: Users will not be able to access any service enabled on the outside interface.
*** Output from config line 133, "static (inside,outside) ..."
Cryptochecksum (unchanged): 9d24f795 66ec86da f17751a8 e623b337
Type help or '?' for a list of available commands.
alexandre> en
Password: **********
alexandre#
alexandre# show running-config
: Saved
ASA Version 8.2(5)
hostname alexandre
domain-name test.net
enable password HdJHW69ZP8sZZbHH encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 192.168.1.2 Device-002
name 192.168.1.3 Device-003
name 192.168.1.4 Device-004
name 192.168.1.5 Device-005
name 192.168.1.9 Server-02
name 192.168.1.10 Server-01
name 192.168.1.11 Device-011
name 192.168.1.12 Server-03
name 192.168.1.50 Device-050
name 192.168.1.51 Device-051
name 192.168.1.52 Device-052
name 192.168.1.53 Device-053
name 192.168.1.54 Device-054
name 192.168.1.55 Device-055
name 192.168.1.60 Device-060
name 192.168.1.61 Device-061
name 192.168.1.62 Device-062
name 192.168.1.63 Device-063
name 192.168.1.70 Device-070
name 192.168.1.71 Device-071
name 192.168.1.72 Device-072
name 192.168.1.73 Device-073
name 108.188.105.83 tst-VPN
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns server-group DefaultDNS
 domain-name test.net
object-group network DM_INLINE_NETWORK_1
 network-object host Server-01
 network-object host Device-011
 network-object host Server-03
 network-object host Server-02
object-group network DM_INLINE_NETWORK_2
 network-object host Device-002
 network-object host Device-003
 network-object host Device-005
object-group network DM_INLINE_NETWORK_3
 network-object host Device-050
 network-object host Device-051
 network-object host Device-052
 network-object host Device-053
 network-object host Device-054
 network-object host Device-055
object-group network DM_INLINE_NETWORK_4
 network-object host Device-060
 network-object host Device-061
 network-object host Device-062
 network-object host Device-063
object-group network DM_INLINE_NETWORK_5
 network-object host Device-070
 network-object host Device-071
 network-object host Device-072
 network-object host Device-073
access-list outside_access_in extended permit tcp any interface outside eq 3389
access-list outside_access_in extended permit udp any interface outside eq 3389
access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_1 any
access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_2 any
access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_3 any
access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_4 any
access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_5 any
pager lines 24
logging enable
logging asdm notifications
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) interface Server-01 netmask 255.255.255.255
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
snmp-server host inside Server-01 community ***** version 2c
no snmp-server location
snmp-server contact Doa
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
threat-detection basic-threat
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
webvpn
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:9d24f79566ec86daf17751a8e623b337
: end
alexandre#

Answer 1

Hi,
I presume you are having problems connecting with ASDM from the external network? This would make sense considering the current NAT configuration.
The problem is indeed the "static" command. The problem is that you only have the single public IP address and that is typically used for Dynamic PAT so that internal users can access the internet by using that as their public IP address (through PAT). It is naturally also used to access the ASA as its directly configured on its external interface.
Now that you have configured a Static NAT between 192.168.1.10 and your public IP address on the external interface this means that any connections coming towards the public IP address will be forwarded to the internal host 192.168.1.10. So ASA wont be accepting the connections for any port as they will be forwarded to the internal host.
What you should do is configure Static PAT instead. This is basically a Port Forward configuration for the ports that you need.
So you could try this through the CLI
no static (inside,outside) interface Server-01 netmask 255.255.255.255
static (inside,outside) tcp interface 3389 192.168.1.10 3389 netmask 255.255.255.255
Check that you are in the correct configuration mode though
alexandre> enable
Password: <give the enable password>
alexandre# conf term
alexandre(config)# <now enter the above "static" commands>
What this should do is first remove the Static NAT so that we get rid of the problem in connectivity to the ASA from the external network. Next we add a Static PAT configuration that will only forward the port TCP/3389 for your RDP connections towards the internal host. Any other port of the public IP address (on the external interface) is free to be used for the ASA itself. This should therefore enable you to again access the ASA through ASDM (using port TCP/443)
Hope this helps :)
- Jouni