The answer you can find real easily:
1. How are you connecting to the ASA (Console Cable(blue cable that came with the device), ethernet (cat 5 plugged into ports 0-7 and connected directly to your PC used to connect to the ASA?, or another method?)
2. Ethernet connection = ssh, telnet, web gui IE,Mozilla, Chrome? (port 80 =http, port 443) =https )
3. Without a username required when logging in usually is a telnet connection (note: insecure connection password is sent in clear text, DO NOT USE IF CONNECTING OVER THE INTERNET!. SSL ONLY ON INTERNET CONNECTION.
TELNET NOTE: TELNET SESSIONS WILL USUALLY AUTHENTICATE FROM THE LOCAL AUTHENTICATION SERVER (ASA 5520) AND WILL REQUIRE THE DEFAULT SECURITY LEVEL TO SIGN IN (UNLESS YOU CHANGED THIS SETTING?) Use the default password you set for telnet sessions, if you did not set this then try Cisco's default password, I think it is Cisco for password. Should this not work use the login password you set, if that does not work use the enable password; why? you say, well it is possible you set requirements for telnet logins to use security level authentication 15 (full access or enable security level 7 by accident.)
However if you do use these passwords over telnet please make sure you are doing this on the internal lan. What app or utility are you using to connect? Putty? secureCRT? Telnet (CLI ex: DOS or cmd in xp then type telnet (Asa ip address)), web browser ?
Try using ssh to connect if you are connecting via ethernet, now if you are using the console cable then you use the conf t/line con 0-?/password command in the cli to set this password, if you did not do this at all, then try the default password you used the first time you connected, once logged in type: en "ENTER", you will be asked to input password, use the password you set for the enable password. Once you can enter enable mode, proceed to configure Terminal mode and set the passwords for the console, telnet (if you use it...), and the ssh passwords. Set the authentication level and the authentication server to use when allowing logins. login local = asa usernames and passwords, Radius (Microsoft internet authentication server that uses Active directory users accounts to authenticate, or ldap (server setup to handle ldap requests.)
enable "ENTER"
CONF T enter
line con 0 press Tab (this will drop down a line and display how many console sessions you can set this password for. it looks like Router#line con 0 (0 - 15) meaning if you want to set the password for all 15 sessions the same you type
line con 0 - 15 "ENTER"
RouterLine(0-15)
type password
you will be asked to input the password do so then press enter
follow the screen as it will want you to enter the password again
Once you have set the password you can type a ? and press enter
this will display a list of commands to use, read the descriptions and set the authentication server (do Local and create users on the asa)
authentication level (you will set this to at or below the level your user is set at, if not you will not be allowed to login as your authentication level will be to low and your session is dropped.)
Set the level 1 - 5
create a user and give that user security level 7 - 15 if you plan on using the login for management purposes.
Now you can also tell the ASA to allow specific ip addresses to connect remotely, or deny specific as well as any ip address to connect, whatever you do don't reject any any for remote login you will never get in again unless connected with a console cable.
Once you have set a login level for the line console or telnet, or ssh.
Set a user with the required authentication level as the line or protocols (telnet, ssh), or set the user to 15 and given the user a password. Allowed the required login protocol for your ip address, ip range, or subnet (internal usually), try to connect.
if you are able to hit the login screen, use the password you set to login, and do a sh run, sh start, sh arp, and you like what you see, go ahead and do a copy run start.
this will copy the running configuration (the changes you made) to the startup config (default config before changes) Now if the device gets powered down it will restart with your changes saved and applied. However if you don't like your changes or you are disconnected and cannot reconnect if you did not copy run start, shut ASA down, turn it back on and all the changes you made are gone. You can start over and try again, practice makes perfect....
