Cisco Cloud Web Security (CWS) Using an ASA Connector

I had the opportunity to do a proof-of-concept (POC) for Cisco Cloud Web Security (CWS), formerly known as Scansafe; and SourceFire, which is Cisco's Next-Generation Intrusion Prevention System (NGIPS).

I did CWS first, which is their web filtering using Cisco's Software-as-a-Service (SaaS) cloud solution. This allows companies with existing ASA firewalls and ISR G2 routers (called CWS connectors) to redirect web traffic (HTTP and HTTPS) to Cisco's security cloud solution. I was given an 1.5 months eval license.

The CWS is a huge topic in SITCS (300-207) exam and I'm glad I was able to setup one. It also pushed me to take SITCS and complete my CCNP Security certification.


ciscoasa# show run dns    // ENSURE ASA CAN DNS QUERY SCANSAFE PROXY SERVERS
dns domain-lookup outside   
dns domain-lookup inside
DNS server-group DefaultDNS
    name-server 208.67.222.222
    name-server 208.67.220.220
    domain-name sg.net

ciscoasa# ping google.com
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 216.58.196.174, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/10 ms

ciscoasa(config)# scansafe ?

configure mode commands/options:
  general-options  To configure the Scansafe server and licence related details
ciscoasa(config)# scansafe general-options
ciscoasa(cfg-scansafe)# ?

Scansafe general-options configuration commands:
  license      Specify the scansafe server license provided to you.
  no           Negate a command or set its defaults
  publickey    Specify the location of the scansafe public key file
  retry-count  Specify the number of consecutive attempts to be made before
               declaring the server dead
  server       Specify the scansafe server address and port
ciscoasa(cfg-scansafe)# server ?

scansafe mode commands/options:
  backup   Specify the address of the backup/secondary scansafe server
  primary  Specify the address of the primary scansafe server
ciscoasa(cfg-scansafe)# server primary ?

scansafe mode commands/options:
  fqdn  Specify fully qualified domain name
  ip    Specify IP address
ciscoasa(cfg-scansafe)# server primary fqdn ?

scansafe mode commands/options:
  WORD < 65 char  fully-qualified domain name
ciscoasa(cfg-scansafe)# server primary fqdn proxy2332.scansafe.net ?

scansafe mode commands/options:
  port  Specify the server port to which web traffic must be redirected to.
  <cr>
ciscoasa(cfg-scansafe)# server primary fqdn proxy2332.scansafe.net port ?

scansafe mode commands/options:
  <0-65535>  Port number for web traffic
ciscoasa(cfg-scansafe)# server primary fqdn proxy2332.scansafe.net port 8080   // USE FQDN SINCE THE NEAREST/LOCAL POP PROXY SERVER (SCANSAFE TOWER) WILL BE USED; PROXY SERVER IP MIGHT ALSO CHANGE
ciscoasa(cfg-scansafe)# server backup fqdn access615.cws.sco.cisco.com ?

scansafe mode commands/options:
  port  Specify the server port to which web traffic must be redirected to.
  <cr>
ciscoasa(cfg-scansafe)# server backup fqdn access615.cws.sco.cisco.com port 8080
ciscoasa(cfg-scansafe)# retry-count ?

scansafe mode commands/options:
  <2-100>  Number of attempts to be made
ciscoasa(cfg-scansafe)# retry-count 5
ciscoasa(cfg-scansafe)# license ?

scansafe mode commands/options:
  WORD < 65 char  16 byte scansafe license provided to you
ciscoasa(cfg-scansafe)# license B1310A75BE380A5767F21194930C7XYZ   // GENERATED FROM ADMIN > AUTHENTICATION > COMPANY KEY > GENERATE
ciscoasa(cfg-scansafe)# exit   
ciscoasa(config)# access-list ?

configure mode commands/options:
  WORD < 241 char  Access list identifier
  alert-interval   Specify the alert interval for generating syslog message
                   106001 which alerts that the system has reached a deny flow
                   maximum. If not specified, the default value is 300 sec
  deny-flow-max    Specify the maximum number of concurrent deny flows that can
                   be created. If not specified, the default value is 4096
ciscoasa(config)# access-list HTTP ?

configure mode commands/options:
  deny      Specify packets to reject
  extended  Configure access policy for IP traffic through the system
  line      Use this to specify line number at which ACE should be entered
  permit    Specify packets to forward
  remark    Specify a comment (remark) for the access-list after this keyword
  rename    rename an existing access-list
  standard  Use this to configure policy having destination host or network
            only
  webtype   Use this to configure WebVPN related policy
ciscoasa(config)# access-list HTTP extended ?

configure mode commands/options:
  deny    Specify packets to reject
  permit  Specify packets to forward
ciscoasa(config)# access-list HTTP extended permit ?

configure mode commands/options:
  <0-255>       Enter protocol number (0 - 255)
  ah           
  eigrp        
  esp          
  gre          
  icmp         
  icmp6        
  igmp         
  igrp         
  ip           
  ipinip       
  ipsec        
  nos          
  object        Specify a service object after this keyword
  object-group  Specify a service or protocol object-group after this keyword
  ospf         
  pcp          
  pim          
  pptp         
  snp          
  tcp          
  udp          
ciscoasa(config)# access-list HTTP extended permit tcp ?

configure mode commands/options:
  A.B.C.D                Source IP address
  X:X:X:X::X/<0-128>     Source IPv6 address/prefix
  any                    Abbreviation for source address/mask of
                         0.0.0.0/0.0.0.0 OR source prefix ::/0
  any4                   Abbreviation of source address and mask of 0.0.0.0
                         0.0.0.0
  any6                   Abbreviation for source prefix ::/0
  host                   Use this keyword to configure source host
  interface              Use interface address as source address
  object                 Keyword to enter source object name
  object-group           Network object-group for source address
  object-group-security  Keyword to specify security object-group for source
  object-group-user      Keyword to specify user object-group for source
  security-group         Keyword to specify inline security-group
  user                   Keyword to specify user for source
  user-group             Keyword to specify user-group for source
ciscoasa(config)# access-list HTTP extended permit tcp any ?

configure mode commands/options:
  A.B.C.D                Destination IP address
  X:X:X:X::X/<0-128>     Destination IPv6 address/prefix
  any                    Abbreviation for destination address/mask of
                         0.0.0.0/0.0.0.0 OR destination prefix ::/0
  any4                   Abbreviation for destination address and mask of
                         0.0.0.0 0.0.0.0
  any6                   Abbreviation for destination prefix ::/0
  eq                     Port equal to operator
  gt                     Port greater than operator
  host                   Use this keyword to configure destination host
  interface              Use interface address as destination address
  lt                     Port less than operator
  neq                    Port not equal to operator
  object                 Keyword to enter destination object name
  object-group           Optional service object-group name for source port or
                         network object-group for destination address
  object-group-security  Keyword to specify security object-group for
                         destination
  range                  Port range operator
  security-group         Keyword to specify inline security-group
ciscoasa(config)# access-list HTTP extended permit tcp any any ?

configure mode commands/options:
  eq            Port equal to operator
  gt            Port greater than operator
  inactive      Keyword for disabling an ACL element
  log           Keyword for enabling log option on this ACL element
  lt            Port less than operator
  neq           Port not equal to operator
  object-group  Optional service object-group for destination port
  range         Port range operator
  time-range    Keyword for attaching time-range option to this ACL element
  <cr>
ciscoasa(config)# access-list HTTP extended permit tcp any any eq ?

configure mode commands/options:
  <1-65535>        Enter port number (1 - 65535)
  aol             
  bgp             
  chargen         
  cifs            
  citrix-ica      
  cmd             
  ctiqbe          
  daytime         
  discard         
  domain          
  echo            
  exec            
  finger          
  ftp             
  ftp-data        
  gopher          
  h323            
  hostname        
  http            
  https           
  ident           
  imap4           
  irc             
  kerberos        
  klogin          
  kshell          
  ldap            
  ldaps           
  login           
  lotusnotes      
  lpd             
  netbios-ssn     
  nfs             
  nntp            
  pcanywhere-data 
  pim-auto-rp     
  pop2            
  pop3            
  pptp            
  rsh             
  rtsp            
  sip             
  smtp            
  sqlnet          
  ssh             
  sunrpc          
  tacacs          
  talk            
  telnet          
  uucp            
  whois           
  www             
ciscoasa(config)# access-list HTTP extended permit tcp any any eq www
ciscoasa(config)# access-list HTTPS extended permit tcp any any eq https
ciscoasa(config)# class-map ?

configure mode commands/options:
  WORD < 41 char  class-map name
  type            Specifies the type of class-map
ciscoasa(config)# class-map CMAP-HTTP
ciscoasa(config-cmap)# ?

MPF class-map configuration commands:
  description  Specify class-map description
  exit         Exit from MPF class-map configuration mode
  help         Help for MPF class-map configuration commands
  match        Configure classification criteria
  no           Negate or set default values of a command
  rename       Rename this class-map
ciscoasa(config-cmap)# match ?

mpf-class-map mode commands/options:
  access-list                 Match an Access List
  any                         Match any packet
  default-inspection-traffic  Match default inspection traffic:
                              ctiqbe----tcp--2748      dns-------udp--53      
                              ftp-------tcp--21        gtp-------udp--2123,3386
                              h323-h225-tcp--1720      h323-ras--udp--1718-1719
                              http------tcp--80        icmp------icmp         
                              ils-------tcp--389       ip-options-----rsvp    
                              mgcp------udp--2427,2727 netbios---udp--137-138 
                              radius-acct----udp--1646 rpc-------udp--111     
                              rsh-------tcp--514       rtsp------tcp--554     
                              sip-------tcp--5060      sip-------udp--5060    
                              skinny----tcp--2000      smtp------tcp--25      
                              sqlnet----tcp--1521      tftp------udp--69      
                              waas------tcp--1-65535   xdmcp-----udp--177     
  dscp                        Match IP DSCP (DiffServ CodePoints)
  flow                        Flow based Policy
  port                        Match TCP/UDP port(s)
  precedence                  Match IP precedence
  rtp                         Match RTP port numbers
  tunnel-group                Match a Tunnel Group
ciscoasa(config-cmap)# match access-list ?

mpf-class-map mode commands/options:
  WORD  Access List name
ciscoasa(config-cmap)# match access-list HTTP
ciscoasa(config-cmap)# exit
ciscoasa(config)# class-map CMAP-HTTPS
ciscoasa(config-cmap)# match access-list HTTPS
ciscoasa(config-cmap)# exit
ciscoasa(config)# policy-map ?

configure mode commands/options:
  WORD < 41 char  policy-map name
  type            Specifies the type of policy-map
ciscoasa(config)# policy-map type ?

configure mode commands/options:
  inspect  Configure a policy-map of type inspect
ciscoasa(config)# policy-map type inspect ?

configure mode commands/options:
  dcerpc             Configure a policy-map of type DCERPC
  dns                Configure a policy-map of type DNS
  esmtp              Configure a policy-map of type ESMTP
  ftp                Configure a policy-map of type FTP
  gtp                Configure a policy-map of type GTP
  h323               Configure a policy-map of type H.323
  http               Configure a policy-map of type HTTP
  im                 Configure a policy-map of type IM
  ip-options         Configure a policy-map of type IP-OPTIONS
  ipsec-pass-thru    Configure a policy-map of type IPSEC-PASS-THRU
  ipv6               Configure a policy-map of type IPv6
  mgcp               Configure a policy-map of type MGCP
  netbios            Configure a policy-map of type NETBIOS
  radius-accounting  Configure a policy-map of type Radius Accounting
  rtsp               Configure a policy-map of type RTSP
  scansafe           Configure a policy-map of type SCANSAFE
  sip                Configure a policy-map of type SIP
  skinny             Configure a policy-map of type Skinny
ciscoasa(config)# policy-map type inspect scansafe ?

configure mode commands/options:
  WORD < 41 char  policy-map name
ciscoasa(config)# policy-map type inspect scansafe HTTP-PMAP
ciscoasa(config-pmap)# ?

MPF policy-map configuration commands
  class        Policy criteria
  description  Specify policy-map description
  exit         Exit from MPF policy-map configuration mode
  help         Help for MPF policy-map configuration commands
  no           Negate or set default values of a command
  parameters   Specify this keyword to enter policy parameters.
  rename       Rename this policy-map
  <cr>
ciscoasa(config-pmap)# parameters ?

mpf-policy-map mode commands/options:
  <cr>
ciscoasa(config-pmap)# parameters
ciscoasa(config-pmap-p)# ?

MPF policy-map parameter configuration commands:
  class    Policy criteria
  default  Specify the default user and group name
  exit     Exit from MPF policy-map parameter configuration submode
  help     Help for MPF policy-map parameter submode commands
  http     Specify that the web traffic needs to be redirected to Scansafe
           server
  https    Specify that the ssl traffic needs to be redirected to Scansafe
           server
  match    Specify policy criteria via inline match
  no       Negate or set default values of a command
  quit     Exit from MPF policy-map parameter configuration submode
  <cr>
ciscoasa(config-pmap-p)# http
ciscoasa(config-pmap-p)# exit
ciscoasa(config-pmap)# exit
ciscoasa(config)# policy-map type inspect scansafe HTTP-PMAPS
ciscoasa(config-pmap)# parameters
ciscoasa(config-pmap-p)# https
ciscoasa(config-pmap-p)# exit
ciscoasa(config-pmap)# exit
ciscoasa(config)# policy-map ?

configure mode commands/options:
  WORD < 41 char  policy-map name
  type            Specifies the type of policy-map
ciscoasa(config)# policy-map PMAP-WEBTRAFFIC
ciscoasa(config-pmap)# ?

MPF policy-map configuration commands
  class        Policy criteria
  description  Specify policy-map description
  exit         Exit from MPF policy-map configuration mode
  help         Help for MPF policy-map configuration commands
  no           Negate or set default values of a command
  rename       Rename this policy-map
  <cr>
ciscoasa(config-pmap)# class ?

mpf-policy-map mode commands/options:
  WORD            class-map name
  class-default   System default class matching otherwise unclassified packets

configure mode commands/options:
  WORD < 41 char  class-map name
  type            Specifies the type of class-map
ciscoasa(config-pmap)# class CMAP-HTTP
ciscoasa(config-pmap-c)# ?

MPF policy-map class configuration commands:
  cxsc             Send traffic to CXSC blade
  exit             Exit from MPF class action configuration mode
  help             Help for MPF policy-map class/match submode commands
  no               Negate or set default values of a command
  police           Rate limit traffic for this class
  priority         Strict scheduling priority for this class
  quit             Exit from MPF class action configuration mode
  set              Set connection values
  user-statistics  configure user statistics for identity firewall
  <cr>
  csc              Content Security and Control service module
  flow-export      Configure filters for NetFlow events
  inspect          Protocol inspection services
  ips              Intrusion prevention services
ciscoasa(config-pmap-c)# inspect ?

mpf-policy-map-class mode commands/options:
  ctiqbe          
  dcerpc          
  dns             
  esmtp           
  ftp             
  gtp             
  h323            
  http            
  icmp            
  ils             
  im              
  ip-options      
  ipsec-pass-thru 
  ipv6            
  mgcp            
  mmp             
  netbios         
  pptp            
  rsh             
  rtsp            
  scansafe        
  sip             
  skinny          
  snmp            
  sqlnet          
  sunrpc          
  tftp            
  waas            
  xdmcp           
ciscoasa(config-pmap-c)# inspect scansafe ?

mpf-policy-map-class mode commands/options:
  WORD < 41 char  scansafe type policy-map name
ciscoasa(config-pmap-c)# inspect scansafe HTTP-PMAP ?

mpf-policy-map-class mode commands/options:
  fail-close  If scansafe servers are not reachable then close the connection.
  fail-open   If scansafe servers are not reachable then open the connection
              directly.
  <cr>
ciscoasa(config-pmap-c)# inspect scansafe HTTP-PMAP fail-open
ciscoasa(config-pmap-c)# inspect scansafe HTTPS-PMAP fail-open
ciscoasa(config-pmap-c)# exit
ciscoasa(config-pmap)# exit
ciscoasa(config)# service-policy ?

configure mode commands/options:
Available policy-maps:
  global_policy
  PMAP-WEBTRAFFIC
ciscoasa(config)# service-policy PMAP-WEBTRAFFIC ?

configure mode commands/options:
  global     Enter this keyword to specify a global policy
  interface  Enter this keyword to specify an interface policy
ciscoasa(config)# service-policy PMAP-WEBTRAFFIC interface ?

configure mode commands/options:
Current available interface(s):
  inside      Name of interface GigabitEthernet0/2
  management  Name of interface Management0/0
  outside     Name of interface GigabitEthernet0/0
ciscoasa(config)# service-policy PMAP-WEBTRAFFIC interface inside


Here are some useful ASA CLI show commands:
 
ciscoasa# show run scansafe    // TO VERIFY SCANSAFE (CWS) CONFIG
!
scansafe general-options
 server primary fqdn proxy2332.scansafe.net port 8080
 server backup fqdn access615.cws.sco.cisco.com port 8080
 retry-count 5
 license UqSGYa8xyWWqJ5x1 encrypted

ciscoasa# show scansafe ?

  server      Show scansafe server status
  statistics  Show scansafe server statistics

ciscoasa# show scansafe server
Primary: proxy2332.scansafe.net (202.79.203.106) (REACHABLE)*    // EQUINIX ASIA IP ADDRESS
Backup: access615.cws.sco.cisco.com (108.171.133.142)   // CISCO USA IP ADDRESS

ciscoasa# show scansafe statistics
Current HTTP sessions : 3
Current HTTPS sessions : 11
Total HTTP Sessions : 460
Total HTTPS Sessions : 373
Total Fail HTTP sessions : 0
Total Fail HTTPS sessions : 0
Total Bytes In : 17331806 Bytes
Total Bytes Out : 2506536 Bytes
HTTP session Connect Latency in ms(min/max/avg) : 4/272/20
HTTPS session Connect Latency in ms(min/max/avg) : 3/272/3

ciscoasa# show conn scansafe
45 in use, 397 most used
TCP outside  209.68.0.123(202.79.203.789):80 inside  10.100.2.47:29861, idle 0:00:01, bytes 3109, flags UFxIO Z
TCP outside  209.68.0.123(202.79.203.789):80 inside   10.100.2.47:27512, idle 0:09:47, bytes 5835, flags UFxIO Z
TCP outside  209.68.0.123(202.79.203.789):80 inside  10.100.2.47:26616, idle 0:21:20, bytes 3592, flags UFxIO Z
TCP outside  216.58.196.456(202.79.203.789):443 inside  10.100.2.47:26647, idle 0:18:09, bytes 4822, flags UFxIO Z
TCP outside  216.58.196.456174(202.79.203.789):443 inside  10.100.2.47:26644, idle 0:18:06, bytes 3673, flags UFxIO Z
TCP outside  216.58.196.456(202.79.203.789):443 inside   10.100.2.47:26642, idle 0:18:08, bytes 3471, flags UFxIO Z
TCP outside  50.31.164.456(202.79.203.789):443 inside  10.100.2.47:27554, idle 0:09:39, bytes 2529, flags UFxIO Z

<OUTPUT TRUNCATED>


This is the CWS portal web page. Upon initial login, it will ask you to change to a "complex" password of at least 8 characters length, alphanumeric, upper and lower case and using a special symbol or character. Upon successful login, you'll be re-directed to the CWS dashboard.

This is where the  Scansafe "license" key will be generated and to be configured on the CWS connector: Go to Admin > Authentication > Company Key > click Generate. Just copy and paste into notepad or you could also email a copy of the license key.

Before creating the URL policy, you'll create a filter first (MY_FILTER). For domain blocking, I've blocked Cisco, CNN and Facebook websites. This is similar on what we do on OpenDNS console except that we could use any DNS servers on the inside clients. Then create the web filtering policy (MY_POLICY) and apply the filter created earlier. There's also an option to choose a schedule to apply your policy.

An "Access Denied" page will be displayed if the domain name matches the URL filter policy.

As a troubleshooting step on the client PC, we could open a web browser and type whoami.scansafe.net on the address bar to know if the CWS policies are being applied.

  

Below is an example of a client where CWS policy was applied on the client. There's a caveat or "gotcha" for HTTPS traffic and that is to create certificates. There are two approach to generate CWS certificate: one is a self-signed certificate and manually deploy it to clients; the other approach is to generate a Certificate Signing Request (CSR) to get and upload an Secure Sockets Layer (SSL) certificate from a third party Certificate Authority (CA) like Verisign or GoDaddy.

Aside from domain or URL filter, we could go granular by blocking web contents such as pictures and videos that are displayed on a website, block Windows update and stopped Internet Explorer web browser from being used on client machines.

There are also cool custom reports that can be generated on CWS and exported to either a PDF or CSV file.

Cisco ASA 9.0 Upgrade Path

I was asked to do a proof of concept (POC) for Cisco Cloud Web Security (CWS) and used a spare ASA 5510 firewall as a CWS connector. In order to run Scansafe commands, the ASA code must be 9.0.4 (minimum) or 9.1.5 above (recommended). I just couldn't upgrade the ASA directly from 8.2 to 9.0 and must follow the upgrade path: 8.2(x) and earlier > 8.4(6) > 9.x or later.

So I've upgrade the Cisco ASA 5510 firewall as well as its ASDM image (for GUI). The ASDM image 7.1(4) is compatible with ASA code 9.0.4. Notice that the upgrade requires a 1 GB RAM but I can still run the said ASA code with a 256 MB RAM since I'm only testing this in a small network environment.


ciscoasa# show version

Cisco Adaptive Security Appliance Software Version 8.2(2)
Device Manager Version 6.1(5)51

Compiled on Mon 11-Jan-10 14:19 by builders
System image file is "disk0:/asa822-k8.bin"
Config file at boot was "startup-config"

ciscoasa up 16 mins 9 secs

Hardware:   ASA5510, 256 MB RAM, CPU Pentium 4 Celeron 1600 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                             Boot microcode   : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.04
 0: Ext: Ethernet0/0         : address is 0021.a049.38dc, irq 9
 1: Ext: Ethernet0/1         : address is 0021.a049.38dd, irq 9
 2: Ext: Ethernet0/2         : address is 0021.a049.38de, irq 9
 3: Ext: Ethernet0/3         : address is 0021.a049.38df, irq 9
 4: Ext: Management0/0       : address is 0021.a049.38e0, irq 11
 5: Int: Not used            : irq 11
 6: Int: Not used            : irq 5
             
Licensed features for this platform:
Maximum Physical Interfaces    : Unlimited
Maximum VLANs                  : 50       
Inside Hosts                   : Unlimited
Failover                       : Disabled
VPN-DES                        : Enabled  
VPN-3DES-AES                   : Enabled  
Security Contexts              : 0        
GTP/GPRS                       : Disabled 
SSL VPN Peers                  : 2        
Total VPN Peers                : 250      
Shared License                 : Disabled
AnyConnect for Mobile          : Disabled 
AnyConnect for Cisco VPN Phone : Disabled 
AnyConnect Essentials          : Disabled 
Advanced Endpoint Assessment   : Disabled 
UC Phone Proxy Sessions        : 2        
Total UC Proxy Sessions        : 2        
Botnet Traffic Filter          : Disabled 

This platform has a Base license.

Serial Number: JMX1302LABC
Configuration register is 0x1
Configuration has not been modified since last system restart.


ciscoasa(config)# interface eth0/1
ciscoasa(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ciscoasa(config-if)# ip address 192.168.1.2 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# ping 192.168.1.1    // TFTP SERVER/PC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

ciscoasa(config-if)# copy tftp://192.168.1.1/asa846-k8.bin flash
Address or name of remote host [192.168.1.1]?
Source filename [asa846-k8.bin]?
Destination filename [asa846-k8.bin]?

Accessing tftp://192.168.1/asa846k8.bin...!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

<OUTPUT TRUNCATED>

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Writing file disk0:/asa846-k8.bin...
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

ciscoasa(config-if)#

ciscoasa(config-if)# show flash: | inc bin

Directory of disk0:/

164    -rwx  14137344    00:06:08 Jan 01 2003  asa804-k8.bin
165    -rwx  7605252     20:10:10 Feb 02 2009  asdm-61551.bin
166    -rwx  7562988     08:47:10 Jan 06 2009  asdm-613.bin
203  590436      Aug 21 2010 21:35:38  crypto_archive/crypto_arch_1.bin
168    -rwx  13879296    17:56:14 Jul 27 2009  asa804-32-k8.bin
175    -rwx  7621596     18:02:14 Jul 27 2009  asdm-61557.bin
176    -rwx  16459776    04:48:38 Feb 05 2010  asa822-k8.bin
177    -rwx  11862220    04:50:10 Feb 05 2010  asdm-625.bin
195    -rwx  24827904    02:48:18 Aug 12 2015  asa846-k8.bin

255844352 bytes total (131547136 bytes free)

ciscoasa(config-if)# boot flash:asa846-k8.bin
INFO: Converting flash:asa846-k8.bin to disk0:/asa846-k8.bin

ciscoasa(config)# write memory
Building configuration...
Cryptochecksum: 12e1858a b157e473 453aeeb0 3ddf3f8d

2659 bytes copied in 3.440 secs (886 bytes/sec)
[OK]

ciscoasa(config)# reload
Proceed with reload? [confirm]

ciscoasa(config)#


***
*** --- START GRACEFUL SHUTDOWN ---
Shutting down isakmp
Shutting down File system


***
*** --- SHUTDOWN NOW ---
Process shutdown finished
Rebooting.....
Restarting system.


<OUTPUT TRUNCATED>

Loading disk0:/asa846-k8.bin... Booting...
Platform ASA5510

Loading...
IO memory blocks requested from bigphys 32bit: 13008
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Starting check/repair pass.
Starting verification pass.
/dev/hda1: 180 files, 30347/62462 clusters
dosfsck(/dev/hda1) returned 0
Processor memory 96468992, Reserved memory: 41943040

Total SSMs found: 0

Total NICs found: 7
mcwa i82557 Ethernet at irq 11  MAC: 0021.a049.38e0
mcwa i82557 Ethernet at irq  5  MAC: 0000.0001.0001
i82547GI rev00 Gigabit Ethernet @ irq11 dev 1 index 05 MAC: 0000.0001.0002
i82546GB rev03 Ethernet @ irq09 dev 2 index 03 MAC: 0021.a049.38df
i82546GB rev03 Ethernet @ irq09 dev 2 index 02 MAC: 0021.a049.38de
i82546GB rev03 Ethernet @ irq09 dev 3 index 01 MAC: 0021.a049.38dd
i82546GB rev03 Ethernet @ irq09 dev 3 index 00 MAC: 0021.a049.38dc
Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                             Boot microcode   : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.06
Verify the activation-key, it might take a while...

Licensed features for this platform:
Maximum Physical Interfaces       : Unlimited      perpetual
Maximum VLANs                     : 50             perpetual
Inside Hosts                      : Unlimited      perpetual
Failover                          : Disabled       perpetual
VPN-DES                           : Enabled        perpetual
VPN-3DES-AES                      : Enabled        perpetual
Security Contexts                 : 0              perpetual
GTP/GPRS                          : Disabled       perpetual
AnyConnect Premium Peers          : 2              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 250            perpetual
Total VPN Peers                   : 250            perpetual
Shared License                    : Disabled       perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
UC Phone Proxy Sessions           : 2              perpetual
Total UC Proxy Sessions           : 2              perpetual
Botnet Traffic Filter             : Disabled       perpetual
Intercompany Media Engine         : Disabled       perpetual

This platform has a Base license.

Cisco Adaptive Security Appliance Software Version 8.4(6)

  ****************************** Warning *******************************
  This product contains cryptographic features and is
  subject to United States and local country laws
  governing, import, export, transfer, and use.
  Delivery of Cisco cryptographic products does not
  imply third-party authority to import, export,
  distribute, or use encryption. Importers, exporters,
  distributors and users are responsible for compliance
  with U.S. and local country laws. By using this
  product you agree to comply with applicable laws and
  regulations. If you are unable to comply with U.S.
  and local laws, return the enclosed items immediately.

  A summary of U.S. laws governing Cisco cryptographic
  products may be found at:
  http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

  If you require further assistance please contact us by
  sending email to export@cisco.com.
  ******************************* Warning *******************************

Copyright (c) 1996-2013 by Cisco Systems, Inc.

                Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

                Cisco Systems, Inc.
                170 West Tasman Drive
                San Jose, California 95134-1706


*************************************************************************
**                                                                     **
**   *** WARNING *** WARNING *** WARNING *** WARNING *** WARNING ***   **
**                                                                     **
**          ----> Minimum Memory Requirements NOT Met! <----           **
**                                                                     **
**  Installed RAM:  256 MB                                             **
**  Required  RAM: 1024 MB                                             **
**  Upgrade part#: ASA5510-MEM-1GB=                                    **
**                                                                     **
**  This ASA does not meet the minimum memory requirements needed to   **
**  run this image. Please install additional memory (part number      **
**  listed above) or downgrade to ASA version 8.2 or earlier.          **
**  Continuing to run without a memory upgrade is unsupported, and     **
**  critical system features will not function properly.               **
**                                                                     **
*************************************************************************
Reading from flash...
!
REAL IP MIGRATION: WARNING
In this version access-lists used in 'access-group', 'class-map',
'dynamic-filter classify-list', 'aaa match' will be migrated from
using IP address/ports as seen on interface, to their real values.
If an access-list used by these features is shared with per-user ACL
then the original access-list has to be recreated.
INFO: Note that identical IP addresses or overlapping IP ranges on
different interfaces are not detectable by automated Real IP migration.
If your deployment contains such scenarios, please verify your migrated
configuration is appropriate for those overlapping addresses/ranges.
Please also refer to the ASA 8.3 migration guide for a complete
explanation of the automated migration process.

INFO: MIGRATION - Saving the startup configuration to file

INFO: MIGRATION - Startup configuration saved to file 'flash:8_2_2_0_startup_cfg.sav'
*** Output from config line 4, "ASA Version 8.2(2) "
.
Cryptochecksum (unchanged): 12e1858a b157e473 453aeeb0 3ddf3f8d
Real IP migration logs:
    No ACL was changed as part of Real-ip migration

INFO: MIGRATION - Saving the startup errors to file 'flash:upgrade_startup_errors_201508120253.log'
Type help or '?' for a list of available commands.

ciscoasa> show version

*************************************************************************
**                                                                     **
**   *** WARNING *** WARNING *** WARNING *** WARNING *** WARNING ***   **
**                                                                     **
**          ----> Minimum Memory Requirements NOT Met! <----           **
**                                                                     **
**  Installed RAM:  256 MB                                             **
**  Required  RAM: 1024 MB                                             **
**  Upgrade part#: ASA5510-MEM-1GB=                                    **
**                                                                     **
**  This ASA does not meet the minimum memory requirements needed to   **
**  run this image. Please install additional memory (part number      **
**  listed above) or downgrade to ASA version 8.2 or earlier.          **
**  Continuing to run without a memory upgrade is unsupported, and     **
**  critical system features will not function properly.               **
**                                                                     **
*************************************************************************

Cisco Adaptive Security Appliance Software Version 8.4(6)
Device Manager Version 6.1(5)51

Compiled on Fri 26-Apr-13 09:00 by builders
System image file is "disk0:/asa846-k8.bin"
Config file at boot was "startup-config"

ciscoasa up 17 mins 6 secs

Hardware:   ASA5510, 256 MB RAM, CPU Pentium 4 Celeron 1600 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash M50FW080 @ 0xfff00000, 1024KB

Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
                             Boot microcode   : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.06
                             Number of accelerators: 1

 0: Ext: Ethernet0/0         : address is 0021.a049.38dc, irq 9
 1: Ext: Ethernet0/1         : address is 0021.a049.38dd, irq 9
 2: Ext: Ethernet0/2         : address is 0021.a049.38de, irq 9
 3: Ext: Ethernet0/3         : address is 0021.a049.38df, irq 9
 4: Ext: Management0/0       : address is 0021.a049.38e0, irq 11
 5: Int: Not used            : irq 11
 6: Int: Not used            : irq 5

Licensed features for this platform:
Maximum Physical Interfaces       : Unlimited      perpetual
Maximum VLANs                     : 50             perpetual
Inside Hosts                      : Unlimited      perpetual
Failover                          : Disabled       perpetual
VPN-DES                           : Enabled        perpetual
VPN-3DES-AES                      : Enabled        perpetual
Security Contexts                 : 0              perpetual
GTP/GPRS                          : Disabled       perpetual
AnyConnect Premium Peers          : 2              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 250            perpetual
Total VPN Peers                   : 250            perpetual
Shared License                    : Disabled       perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
UC Phone Proxy Sessions           : 2              perpetual
Total UC Proxy Sessions           : 2              perpetual
Botnet Traffic Filter             : Disabled       perpetual
Intercompany Media Engine         : Disabled       perpetual

This platform has a Base license.

Serial Number: JMX1302LABC
Configuration register is 0x1
             
Configuration has not been modified since last system restart.

ciscoasa> enable
Password:<ENTER>

ciscoasa# configure terminal
ciscoasa(config)#

***************************** NOTICE *****************************

Help to improve the ASA platform by enabling anonymous reporting,
which allows Cisco to securely receive minimal error and health
information from the device. To learn more about this feature,
please visit: http://www.cisco.com/go/smartcall

Would you like to enable anonymous error reporting to help improve

the product? [Y]es, [N]o, [A]sk later: n

In the future, if you would like to enable this feature,
issue the command "call-home reporting anonymous".

Please remember to save your configuration.


ciscoasa(config)# interface eth01 /1
ciscoasa(config-if)# ip address 192.168.1.2 255.255.255,0 .0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# copy tftp://192.168.1.1/asa904-k8.bin flash
Address or name of remote host [192.168.1.1]?
Source filename [asa904-k8.bin]?
Destination filename [asa904-k8.bin]?

Accessing tftp://192.168.1.1/asa904k8.bin...!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

<OUTPUT TRUNCATED>

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

ciscoasa(config-if)# show flash | i bin
  165  14137344    Jan 01 2003 00:06:08  asa804-k8.bin
  166  7605252     Feb 02 2009 20:10:10  asdm-61551.bin
  203  590436      Aug 21 2010 21:35:38  crypto_archive/crypto_arch_1.bin
  167  7562988     Jan 06 2009 08:47:10  asdm-613.bin
  169  13879296    Jul 27 2009 17:56:14  asa804-32-k8.bin
  176  7621596     Jul 27 2009 18:02:14  asdm-61557.bin
  177  16459776    Feb 05 2010 04:48:38  asa822-k8.bin
  178  11862220    Feb 05 2010 04:50:10  asdm-625.bin
  196  24827904    Aug 12 2015 02:48:18  asa846-k8.bin
  201  27629568    Aug 12 2015 03:12:30  asa904-k8.bin

ciscoasa(config-if)# sh run boot
boot system disk0:/asa846-k8.bin
boot system disk0:/asa904-k8.bin
ciscoasa(config-if)# no boot system disk0:/asa846-k8.bin
ciscoasa(config)# write memory
Building configuration...
Cryptochecksum: 9b45c472 2f66cd0f 15ba3a35 b4262c94

2730 bytes copied in 3.370 secs (910 bytes/sec)
[OK]

ciscoasa# reload
Proceed with reload? [confirm]

ciscoasa#


***
*** --- START GRACEFUL SHUTDOWN ---
Shutting down isakmp
Shutting down File system


***
*** --- SHUTDOWN NOW ---
Process shutdown finished
Rebooting.....


Booting system, please wait...

<OUTPUT TRUNCATED>

Loading disk0:/asa904-k8.bin... Booting...
Platform ASA5510

Loading...
IO memory blocks requested from bigphys 32bit: 13264
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Starting check/repair pass.
Starting verification pass.
/dev/hda1: 188 files, 37096/62462 clusters
dosfsck(/dev/hda1) returned 0
Processor memory 92274688, Reserved memory: 41943040

Total SSMs found: 0

Total NICs found: 7
mcwa i82557 Ethernet at irq 11  MAC: 0021.a049.38e0
mcwa i82557 Ethernet at irq  5  MAC: 0000.0001.0001
i82547GI rev00 Gigabit Ethernet @ irq11 dev 1 index 05 MAC: 0000.0001.0002
i82546GB rev03 Ethernet @ irq09 dev 2 index 03 MAC: 0021.a049.38df
i82546GB rev03 Ethernet @ irq09 dev 2 index 02 MAC: 0021.a049.38de
i82546GB rev03 Ethernet @ irq09 dev 3 index 01 MAC: 0021.a049.38dd
i82546GB rev03 Ethernet @ irq09 dev 3 index 00 MAC: 0021.a049.38dc

INFO: Unable to read cluster interface-mode from flash
       Writing default mode "None" to flash
Verify the activation-key, it might take a while...

Licensed features for this platform:
Maximum Physical Interfaces       : Unlimited      perpetual
Maximum VLANs                     : 50             perpetual
Inside Hosts                      : Unlimited      perpetual
Failover                          : Disabled       perpetual
Encryption-DES                    : Enabled        perpetual
Encryption-3DES-AES               : Enabled        perpetual
Security Contexts                 : 0              perpetual
GTP/GPRS                          : Disabled       perpetual
AnyConnect Premium Peers          : 2              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 250            perpetual
Total VPN Peers                   : 250            perpetual
Shared License                    : Disabled       perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
UC Phone Proxy Sessions           : 2              perpetual
Total UC Proxy Sessions           : 2              perpetual
Botnet Traffic Filter             : Disabled       perpetual
Intercompany Media Engine         : Disabled       perpetual
Cluster                           : Disabled       perpetual

This platform has a Base license.

Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x0)
                             Boot microcode        : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.08

Cisco Adaptive Security Appliance Software Version 9.0(4)

  ****************************** Warning *******************************
  This product contains cryptographic features and is
  subject to United States and local country laws
  governing, import, export, transfer, and use.
  Delivery of Cisco cryptographic products does not
  imply third-party authority to import, export,
  distribute, or use encryption. Importers, exporters,
  distributors and users are responsible for compliance
  with U.S. and local country laws. By using this
  product you agree to comply with applicable laws and
  regulations. If you are unable to comply with U.S.
  and local laws, return the enclosed items immediately.

  A summary of U.S. laws governing Cisco cryptographic
  products may be found at:
  http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

  If you require further assistance please contact us by
  sending email to export@cisco.com.
  ******************************* Warning *******************************

This product includes software developed by the OpenSSL Project
for use in the OpenSSL Toolkit (http://www.openssl.org/)
Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
All rights reserved.
Copyright (c) 1998-2011 The OpenSSL Project.
All rights reserved.

This product includes software developed at the University of
California, Irvine for use in the DAV Explorer project
(http://www.ics.uci.edu/~webdav/)
Copyright (c) 1999-2005 Regents of the University of California.
All rights reserved.

Busybox, version 1.16.1, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
Busybox comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

DOSFSTOOLS, version 2.11, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA 02111-1307
675 Mass Ave, Cambridge, MA 02139
DOSFSTOOLS comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

grub, version 0.94, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA 02111-1307
grub comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

libgcc, version 4.3, Copyright (C) 2007 Free Software Foundation, Inc.
libgcc comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

libstdc++, version 4.3, Copyright (C) 2007 Free Software Foundation, Inc.
libstdc++ comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

Linux kernel, version 2.6.29.6, Copyright (C) 1989, 1991 Free Software
Foundation, Inc.
51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
Linux kernel comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

module-init-tools, version 3.10, Copyright (C) 1989, 1991 Free Software
Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
module-init-tools comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

numactl, version 2.0.3, Copyright (C) 2008 SGI.
Author: Andi Kleen, SUSE Labs
Version 2.0.0 by Cliff Wickman, Chritopher Lameter and Lee Schermerhorn
numactl comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

pciutils, version 3.1.4, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
pciutils comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

readline, version 5.2, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
59 Temple Place, Suite 330, Boston, MA 02111 USA
readline comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

udev, version 146, Copyright (C) 1989, 1991 Free Software Foundation, Inc.
51 Franklin St, Fifth Floor, Boston, MA 02110-1301  USA
udev comes with ABSOLUTELY NO WARRANTY.
This is free software, and you are welcome to redistribute it under the General
Public License v.2 (http://www.gnu.org/licenses/gpl-2.0.html)
See User Manual (''Licensing'') for details.

Cisco Adapative Security Appliance Software, version 9.0,
Copyright (c) 1996-2013 by Cisco Systems, Inc.
Certain components of Cisco ASA Software, Version 9.0 are licensed under the GNU
Lesser Public License (LGPL) Version 2.1.  The software code licensed under LGPL
Version 2.1 is free software that comes with ABSOLUTELY NO WARRANTY.  You can
redistribute and/or modify such LGPL code under the terms of LGPL Version 2.1
(http://www.gnu.org/licenses/lgpl-2.1.html).  See User Manual for licensing
details.

                Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set f(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

                Cisco Systems, Inc.
                170 West Tasman Drive
                San Jose, California 95134-1706


*************************************************************************
**                                                                     **
**   *** WARNING *** WARNING *** WARNING *** WARNING *** WARNING ***   **
**                                                                     **
**          ----> Minimum Memory Requirements NOT Met! <----           **
**                                                                     **
**  Installed RAM:  256 MB                                             **
**  Required  RAM: 1024 MB                                             **
**  Upgrade part#: ASA5510-MEM-1GB=                                    **
**                                                                     **
**  This ASA does not meet the minimum memory requirements needed to   **
**  run this image. Please install additional memory (part number      **
**  listed above) or downgrade to ASA version 8.2 or earlier.          **
**  Continuing to run without a memory upgrade is unsupported, and     **
**  critical system features will not function properly.               **
**                                                                     **
*************************************************************************
Reading from flash...
!
ssh key-exchange group dh-group1-sha1
    ^
ERROR: % Invalid Hostname
*** Output from config line 63, "ssh key-exchange group d..."
.
Cryptochecksum (unchanged): 9b45c472 2f66cd0f 15ba3a35 b4262c94
Type help or '?' for a list of available commands.

ciscoasa> show version

*************************************************************************
**                                                                     **
**   *** WARNING *** WARNING *** WARNING *** WARNING *** WARNING ***   **
**                                                                     **
**          ----> Minimum Memory Requirements NOT Met! <----           **
**                                                                     **
**  Installed RAM:  256 MB                                             **
**  Required  RAM: 1024 MB                                             **
**  Upgrade part#: ASA5510-MEM-1GB=                                    **
**                                                                     **
**  This ASA does not meet the minimum memory requirements needed to   **
**  run this image. Please install additional memory (part number      **
**  listed above) or downgrade to ASA version 8.2 or earlier.          **
**  Continuing to run without a memory upgrade is unsupported, and     **
**  critical system features will not function properly.               **
**                                                                     **
*************************************************************************

Cisco Adaptive Security Appliance Software Version 9.0(4)
Device Manager Version 6.1(5)51

Compiled on Wed 04-Dec-13 08:33 by builders
System image file is "disk0:/asa904-k8.bin"
Config file at boot was "startup-config"
ciscoasa up 1 min 53 secs

Hardware:   ASA5510, 256 MB RAM, CPU Pentium 4 Celeron 1600 MHz,
Internal ATA Compact Flash, 256MB
BIOS Flash M50FW080 @ 0xfff00000, 1024KB

Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x0)
                             Boot microcode        : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.08
                             Number of accelerators: 1

 0: Ext: Ethernet0/0         : address is 0021.a049.38dc, irq 9
 1: Ext: Ethernet0/1         : address is 0021.a049.38dd, irq 9
 2: Ext: Ethernet0/2         : address is 0021.a049.38de, irq 9
 3: Ext: Ethernet0/3         : address is 0021.a049.38df, irq 9
 4: Ext: Management0/0       : address is 0021.a049.38e0, irq 11
 5: Int: Not used            : irq 11
 6: Int: Not used            : irq 5

Licensed features for this platform:
Maximum Physical Interfaces       : Unlimited      perpetual
Maximum VLANs                     : 50             perpetual

Inside Hosts                      : Unlimited      perpetual
Failover                          : Disabled       perpetual
Encryption-DES                    : Enabled        perpetual
Encryption-3DES-AES               : Enabled        perpetual
Security Contexts                 : 0              perpetual
GTP/GPRS                          : Disabled       perpetual
AnyConnect Premium Peers          : 2              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 250            perpetual
Total VPN Peers                   : 250            perpetual
Shared License                    : Disabled       perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
UC Phone Proxy Sessions           : 2              perpetual
Total UC Proxy Sessions           : 2              perpetual
Botnet Traffic Filter             : Disabled       perpetual
Intercompany Media Engine         : Disabled       perpetual
Cluster                           : Disabled       perpetual

This platform has a Base license.

Serial Number: JMX1302LABC
             
Configuration register is 0x1
Configuration has not been modified since last system restart.

ciscoasa# show interface ip brief
Interface                  IP-Address      OK? Method Status                Protocol
Ethernet0/0                unassigned      YES unset  administratively down down
Ethernet0/1                192.168.1.2     YES CONFIG up                    up 
Ethernet0/2                unassigned      YES unset  administratively down down
Ethernet0/3                unassigned      YES unset  administratively down down
Management0/0              unassigned      YES unset  administratively down down

ciscoasa# copy tftp://192.168.1.1/asdm-743.bin flash   // COMPATIBLE ASDM
Address or name of remote host [192.168.1.1]?
Source filename [asdm-743.bin]?
Destination filename [asdm-743.bin]?

Accessing tftp://192.168.1.1/asdm-743.bin...!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

<OUTPUT TRUNCATED>

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

24810876 bytes copied in 33.580 secs (751844 bytes/sec)

ciscoasa# configure terminal
ciscoasa(config)# asdm image disk0:/asdm-743.bin

ciscoasa# show run sc?

  scansafe 

ciscoasa# show run scansafe
ciscoasa# configure terminal

ciscoasa(config)# sc?

configure mode commands/options:
  scansafe 

ciscoasa(config)# scansafe ?

configure mode commands/options:
  general-options  To configure the Scansafe server and licence related details

ciscoasa(config)# scansafe gen

ciscoasa(config)# scansafe general-options ?

configure mode commands/options:
  <cr>

ciscoasa(config)# scansafe general-options

ciscoasa(cfg-scansafe)# ?

Scansafe general-options configuration commands:
  license      Specify the scansafe server license provided to you.
  no           Negate a command or set its defaults
  publickey    Specify the location of the scansafe public key file
  retry-count  Specify the number of consecutive attempts to be made before
               declaring the server dead
  server       Specify the scansafe server address and port