Cisco – ASA FTP Special Character in password issue

ciscocisco-asa

I am trying to copy a show tech from an ASA to a remote server via FTP.
My issue is that the password I am providing has a '@' and it is being interpreted incorrectly by the CLI. I have tried putting a '\@' but the command still fails.

Anyone have any luck with this?

This works

  show tech-support file ftp://username:password@xxx.xxx.xxx.xxx/ASA-SHOW-TECH

This Does not work

  show tech-support file ftp://username:p@ssword@xxx.xxx.xxx.xxx/ASA-SHOW-TECH

Best Answer

The problem here is that the device is interpreting the first @ as the delimiter between the credentials and the FTP server address.

Perhaps configuring the username and password in global-configuration mode and then redirecting the show tech without specifying the credentials would do the trick. Otherwise, and I know this is a wimpy solution, changing the password to not include that one character may be the easiest and perhaps most secure way of working around this issue.

Related Solutions

Cisco ASA – Remote Users Cannot Access Site-to-Site Tunnel

Got a response on the cisco forums that solved my problem.

you are missing NAT exempt from the IP local pool to the destination of the site to site:

access-list NAT_EXEMPT permit ip 10.0.0.0 255.255.255.0 172.17.0.0 255.255.0.0

NAT (outside) 0 access-list NAT_EXEMPT

Cisco ASA VPNs – Sharing Dynamic and Static Crypto ACL?

When the ASA attempts to send traffic out an interface where a crypto map is applied, it will always process the crypto map from top-down, looking for the first match. Therefore, it will always match sequence 11, and never sequence 16. So the behavior you describe above is normal.

One correct way to do this would be to build GRE tunnels with routers, where you can run a dynamic routing protocol to determine the health of the paths. Then, you can wrap the GRE tunnels in IPSec for security. However, you said replacing the hardware is not an option. SDWAN is also another correct solution for this.

But, here's an idea for you, though. If the headquarters never initiates traffic to the remote site (or can withstand an outage when the primary tunnel goes down), you could set it up where the 897 performs NAT on the traffic when it leaves the cellular interface, so that it appears to the HQ that it's a different site. The ASA would then see this "new" site as attached to crypto map sequence 16, instead of 11. This would allow the remote site to maintain connectivity during an outage, but its source addresses would be translated. Then, when the primary internet comes back up, the 897 fails back to the primary path, to the primary tunnel, and to the primary address space. It's a bandaid, but it's an option.

Best Answer

Related Solutions

Cisco ASA – Remote Users Cannot Access Site-to-Site Tunnel

Cisco ASA VPNs – Sharing Dynamic and Static Crypto ACL?

Related Topic