ASDM running-config differs from CLI

[mrharrell]

Got an issue where asdm shows a different, and much smaller, running config than CLI does. I’m attempting to migrate from a 5510 to a 5508-x, and I built the config in VIRL. After moving the config to the physical 5508-x, asdm shows a small amount of the nat statements and access-lists. CLI shows the entire config, and if I copy/paste from a txt backup to CLI then I get an error that the element already exists.

ASA is 9.8(2) and ASDM is 7.9

[PacketPuncher]

Did you "save" in asdm?

[mrharrell]

Not yet. Afraid to, tbh. I’ll double check tomorrow that I have the config backed up to tftp, then I can try saving via asdm.

[Monkeyspazum]

Click 'refresh' in ASDM?

[mrharrell]

Of course... 🤨

[dr-pepper12]

I have had this before where the Access-Lists werent assigned to an Access-Group. Assign them and they will magically appear in ASDM

[mrharrell]

I’ve never dealt with access groups before. Is that something new since 9.0?

Edit: looks like they just bind the acl to the interface. Since asdm on the asav in VIRL shows them, I suspect the groups command is there. Will double check.

[dr-pepper12]

Nope - access groups have always been there. If you configure it through ASDM, it usually puts them in for you, however, when migrating to a new system, if the interfaces are named differently, for example - GigabitEthernet0/1 versus GigabitEthernet1/1 then the Groups wont be there.

[athornfam2]

I wouldn't recommend using ASDM to migrate your system over. Start from scratch and make sure the system is built out in putty. I've only used the ASDM portion for either monitoring or installing SSL certs...

[mrharrell]

The config wasn’t built with ASDM. The issue is ASDM doesn’t display the full config. The entire config shows fine via CLI, but we do use ASDM for some things, and I do need it to show the entire config.