Cisco ASA: “Wrong Serial Number?”

Posted on 27/03/2019 by PeteLong

KB ID 0001530

Problem

Cisco have done this for a while, the first time I saw it was years ago on a 5585, but all the NGFW models now have a ‘Serial Number” and a “Chassis Serial Number”. Normally you don’t care unless you need to log a TAC call online. So you issue a show version command, take a note of the serial number, and then it says, there’s no record of that serial number?

Solution

Just to be clear

SmartNets are registered to the Chassis Serial Number, this is NOT the serial number shown with a ‘show version‘ command.

Software (e.g. AnyConnect) is licensed to the Serial Number that IS shown with a ‘show version‘ command.

As a general rule, Cisco ASA chassis serial numbers start with JMX, and the serial numbers start with JAD.

How to Locate the Cisco ASA ‘Chassis Serial Number’

Well it’s printed on the chassis of course, but if it’s in a rack or a thousand miles away, that’s not much help! To get it remotely you use the ‘show inventory’ command;

[box]

Petes-ASA# show inventory
Name: "Chassis", DESCR: "ASA 5516-X with FirePOWER services, 8GE, AC, DES"
PID: ASA5516           , VID: V05     , SN: JMX1234ABCD

Name: "Storage Device 1", DESCR: "ASA 5516-X SSD"
PID: ASA5516-SSD       , VID: N/A     , SN: MSA21470XXX

Petes-ASA#

[/box]

How to Locate the Cisco ASA ‘Serial Number’

Same as with the old 5500 series firewalls, (and the PIX) use a show version command.

[box]

Petes-ASA# show version

Cisco Adaptive Security Appliance Software Version 9.8(2)24
Firepower Extensible Operating System Version 2.2(2.75)
Device Manager Version 7.8(2)151

Compiled on Thu 01-Mar-18 20:21 PST by builders
System image file is "disk0:/asa982-24-lfbff-k8.SPA"
Config file at boot was "startup-config"

Petes-ASA up 146 days 1 hour
failover cluster up 146 days 1 hour

Hardware:   ASA5516, 8192 MB RAM, CPU Atom C2000 series 2416 MHz, 1 CPU (8 cores)
Internal ATA Compact Flash, 8000MB
BIOS Flash M25P64 @ 0xfed01000, 16384KB

Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
                             Number of accelerators: 1

 1: Ext: GigabitEthernet1/1  : address is 00a7.42e1.6ed6, irq 255
 2: Ext: GigabitEthernet1/2  : address is 00a7.42e1.6ed7, irq 255
 3: Ext: GigabitEthernet1/3  : address is 00a7.42e1.6ed8, irq 255
 4: Ext: GigabitEthernet1/4  : address is 00a7.42e1.6ed9, irq 255
 5: Ext: GigabitEthernet1/5  : address is 00a7.42e1.6eda, irq 255
 6: Ext: GigabitEthernet1/6  : address is 00a7.42e1.6edb, irq 255
 7: Ext: GigabitEthernet1/7  : address is 00a7.42e1.6edc, irq 255
 8: Ext: GigabitEthernet1/8  : address is 00a7.42e1.6edd, irq 255
 9: Int: Internal-Data1/1    : address is 00a7.42e1.6ed5, irq 255
10: Int: Internal-Data1/2    : address is 0000.0001.0002, irq 0
11: Int: Internal-Control1/1 : address is 0000.0001.0001, irq 0
12: Int: Internal-Data1/3    : address is 0000.0001.0003, irq 0
13: Ext: Management1/1       : address is 00a7.42e1.6ed5, irq 0
14: Int: Internal-Data1/4    : address is 0000.0100.0001, irq 0

Licensed features for this platform:
Maximum Physical Interfaces       : Unlimited      perpetual
Maximum VLANs                     : 150            perpetual
Inside Hosts                      : Unlimited      perpetual
Failover                          : Active/Active  perpetual
Encryption-DES                    : Enabled        perpetual
Encryption-3DES-AES               : Enabled        perpetual
Security Contexts                 : 2              perpetual
Carrier                           : Disabled       perpetual
AnyConnect Premium Peers          : 4              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 300            perpetual
Total VPN Peers                   : 300            perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
Shared License                    : Disabled       perpetual
Total TLS Proxy Sessions          : 1000           perpetual
Botnet Traffic Filter             : Disabled       perpetual
Cluster                           : Enabled        perpetual
Cluster Members                   : 2              perpetual
VPN Load Balancing                : Enabled        perpetual


Failover cluster licensed features for this platform:
Maximum Physical Interfaces       : Unlimited      perpetual
Maximum VLANs                     : 150            perpetual
Inside Hosts                      : Unlimited      perpetual
Failover                          : Active/Active  perpetual
Encryption-DES                    : Enabled        perpetual
Encryption-3DES-AES               : Enabled        perpetual
Security Contexts                 : 4              perpetual
Carrier                           : Disabled       perpetual
AnyConnect Premium Peers          : 8              perpetual
AnyConnect Essentials             : Disabled       perpetual
Other VPN Peers                   : 300            perpetual
Total VPN Peers                   : 300            perpetual
AnyConnect for Mobile             : Disabled       perpetual
AnyConnect for Cisco VPN Phone    : Disabled       perpetual
Advanced Endpoint Assessment      : Disabled       perpetual
Shared License                    : Disabled       perpetual
Total TLS Proxy Sessions          : 1000           perpetual
Botnet Traffic Filter             : Disabled       perpetual
Cluster                           : Enabled        perpetual
VPN Load Balancing                : Enabled        perpetual

The Running Activation Key feature: 2000 TLS Proxy sessions exceed the limit on the platform, reduced to 1000 TLS Proxy sessions.

Serial Number: JAD1234ABCD
Running Permanent Activation Key: 0x0037exxx 0x482ffyyy 0x04718yyy 0xaad48xxx 0x49343xxx
Configuration register is 0x1
Image type                : Release
Key Version               : A
Configuration last modified by PeteLong at 13:50:02.750 GMT Tue Mar 26 2019

Petes-ASA#

[/box]

Find out your Cisco ASA version (Operating system and ASDM)

Posted on 17/11/2015 by Migrated

KB ID 0000690

Problem

With all the command changes that have come in in the past few versions, it seems when I get asked ‘how do you do xyz?” my first question is ‘What is the OS version on your ASA?’

So next time I get a blank look, I can just point them here.

Also see: ASA 5505 Determine Your License Version

Solution

Get your ASA version and ASDM version from the ASDM.

1. Connect to the ASA via ASDM.

2. Home > Device Dashboard > Device Information.

Get your ASA version and ASDM version from Command Line.

1. Connect to the ASA via CLI.

2. Execute the following command;

[box]show ver[/box]

Note: This is the shortened version of ‘show version‘.

To download new ASA software go here, (Note: Valid Cisco Warranty/SmartNet, and CCO account required to download software).

Cisco ASA 5500 – Adding Licenses

Posted on 17/11/2015 by Migrated

KB ID 0000531

Problem

Each model in the Cisco ASA 5500 range comes with a range of licences and features, to add these features you can purchase them from a Cisco reseller. You will then need to apply the licence to the device.

Solution

1. Your first step is to purchase the Licence you require from an authorised cisco reseller.

2. When your licence arrives you need to locate the PAK that is on the certificate.

3. You need the Serial number of the ASA 5500, to get this either look on the chassis of the device or issue a “show version” command.

[box]

PetesASA# show version
 
 Cisco Adaptive Security Appliance Software Version 8.0(3)
 Device Manager Version 6.1(3)
 
 Compiled on Tue 06-Nov-07 22:59 by builders
 System image file is "disk0:/asa803-k8.bin"
 Config file at boot was "startup-config"
 
 PetesASA up 5 days 17 hours
 
 Hardware: ASA5510, 256 MB RAM, CPU Pentium 4 Celeron 1600 MHz
 Internal ATA Compact Flash, 256MB
 BIOS Flash M50FW080 @ 0xffe00000, 1024KB
 
 Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
 Boot microcode : CN1000-MC-BOOT-2.00
 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.01
 IPSec microcode : Cnlite-MC-IPSECm-MAIN-2.04
 0: Ext: Ethernet0/0 : address is 001d.70df.3e28, irq 9
 1: Ext: Ethernet0/1 : address is 001d.70df.3e29, irq 9
 2: Ext: Ethernet0/2 : address is 001d.70df.3e2a, irq 9
 3: Ext: Ethernet0/3 : address is 001d.70df.3e2b, irq 9
 4: Ext: Management0/0 : address is 001d.70df.3e27, irq 11
 5: Int: Not used : irq 11
 6: Int: Not used : irq 5
 
 Licensed features for this platform:
 Maximum Physical Interfaces  : Unlimited
 Maximum VLANs                : 100
 Inside Hosts                 : Unlimited
 Failover                     : Active/Active
 VPN-DES                      : Enabled
 VPN-3DES-AES                 : Enabled
 Security Contexts            : 2
 GTP/GPRS                     : Disabled
 VPN Peers                    : 250
 WebVPN Peers                 : 25
 AnyConnect for Mobile        : Disabled
 AnyConnect for Linksys phone : Disabled
 Advanced Endpoint Assessment : Disabled
 
 This platform has an ASA 5510 Security Plus license.
 
 Serial Number: JMX1234ABCD
 Running Activation Key: 0x5c385c4d 0xf8344dbb 0xac3161c8 0xaf983c24 0x88888888
 Configuration register is 0x1
 Configuration has not been modified since last system restart.

[/box]

4. So the one above has a serial Number of JMX1234ABCD.

5. Now you have the PAK and the serial number, you need to register them with Cisco Go there, login with a Cisco CCO account name. Enter the PAK Code > Submit.

6. Check the PAK details, and add more as required > Click “All Done”.

7. Enter the Serial Number of the ASA and tick “I Agree..” > Enter/Check your details > Enter the Licensee details (If Different) > Continue.

8. Read the Summary > Submit > Wait for it to stop saying “Processing” > When complete it should “Go Green” and say Registration Complete.

9. If can take a little while for the licence to be emailed to you and USUALLY goes straight to Junk Mail (Thanks Microsoft, that’s not funny!)

10. When the Licence comes in, the detail that you need is the activation key, it will look like….

dd12eb50 9e16d5bb 45b2a92c 78901838 44999999

11. You add this licence to the ASA with an “activation-key” command:

[box]

PetesASA> enable
 Password: ***********
 PetesASA# configure terminal
 PetesASA(config)# activation-key dd12eb50 9e16d5bb 45b2a92c 78901838 44999999
 
 Licensed features for this platform:
 Maximum Physical Interfaces   : Unlimited
 Maximum VLANs                 : 100
 Inside Hosts                  : Unlimited
 Failover                      : Active/Active
 VPN-DES                       : Enabled
 VPN-3DES-AES                  : Enabled
 Security Contexts             : 2
 GTP/GPRS                      : Disabled
 VPN Peers                     : 250
 WebVPN Peers                  : 50
 AnyConnect for Mobile         : Disabled
 AnyConnect for Linksys phone  : Disabled
 Advanced Endpoint Assessment  : Disabled
 
 This platform has an ASA 5510 Security Plus license.
 
 Both running and flash activation keys were updated with the requested key.
 PetesASA(config)#

[/box]

12. That’s the licence added.

Note: In the example above I added a licence to increase the web VPN peers from 25 to 50 (Which you can see if you compare the two pieces of code).

To add a Licence from the ASDM

1. Connect via ASDM.

2. Navigate to > Configuration > Device Management > Licensing > Activation Key > Paste in the new activation key > Update Activation Key.

PeteNetLive

Technology that 'Just Works'

Tag Archives: show version

Cisco ASA: “Wrong Serial Number?”

Problem

Solution

How to Locate the Cisco ASA ‘Chassis Serial Number’

How to Locate the Cisco ASA ‘Serial Number’

Related Articles, References, Credits, or External Links

Find out your Cisco ASA version (Operating system and ASDM)

Problem

Solution

Get your ASA version and ASDM version from the ASDM.

Get your ASA version and ASDM version from Command Line.

Related Articles, References, Credits, or External Links

Cisco ASA 5500 – Adding Licenses

Problem

Solution

To add a Licence from the ASDM

Related Articles, References, Credits, or External Links