topic Re: Cisco ASA>FTD mgmt in Network Security

Cisco ASA>FTD mgmt

umeshunited — Wed, 09 Sep 2020 05:40:24 GMT

Hello team,

We recently re-imaged 5516-x to FTD.

I am not able to access it using IP assigned to mgmt ip

When I do "show network"

===============[ System Information ]===============
Hostname : testftd
Management port : 8305
IPv4 Default route
Gateway : 10.10.0.1

======================[ br1 ]=======================
State : Enabled
Channels : Management & Events
Mode : Non-Autonegotiation
MDI/MDIX : Auto/MDIX
MTU : 1500
MAC Address : 03:AB:C4:C7:70:96
----------------------[ IPv4 ]----------------------
Configuration : Manual
Address : 10.10.0.60
Netmask : 255.255.255.0
Broadcast : 10.10.0.255
----------------------[ IPv6 ]----------------------
Configuration : Disabled

===============[ Proxy Information ]================
State : Disabled
Authentication : Disabled

When I ping 10.10.0.60 or 10.10.0.1 it says

No route to host X.X.X.X

When I checked in LINA engine Mgmt1/1 interface is admin down.

I selected option to manage it locally while setup.

How can I access it ?

Re: Cisco ASA>FTD mgmt

Rob Ingram — Wed, 09 Sep 2020 06:42:38 GMT

Hi,

Use the command "ping system 10.10.0.60"

HTH

Re: Cisco ASA>FTD mgmt

umeshunited — Wed, 09 Sep 2020 07:04:33 GMT

Hello Rob,

It's pinging. But from outside I am not able to access that IP using https.

Re: Cisco ASA>FTD mgmt

Rob Ingram — Wed, 09 Sep 2020 07:16:57 GMT

If you are using FMC to manage the FTD then you don't connect to it directly on https. You now need to configure it using the FMC.

Re: Cisco ASA>FTD mgmt

umeshunited — Wed, 09 Sep 2020 07:27:40 GMT

Hi,

I am not using FMC, I am planning to administer it locally only using FDM.

Also I tried ping to gateway "ping system 10.10.0.1" and it's not pinging. Switch port config is good I double checked.

Re: Cisco ASA>FTD mgmt

Rob Ingram — Wed, 09 Sep 2020 07:36:57 GMT

Sorry, my mistake, for some reason I thought you were using and FMC.

Have you attempted to connect to the FTD using https from a PC in the same VLAN?

To answer your previous question, you wouldn't be able to access the FTD from the outside, because until you've configured the FTD there is no outside interface, only the mgmt interface.

Re: Cisco ASA>FTD mgmt

Ruben Cocheno — Wed, 09 Sep 2020 10:49:23 GMT

@umeshunited

Connetct your laptop directly to the firewall in case you think that something is not right with your internal network, your should be able to SSH to it.

But give reboot before you try it.

Re: Cisco ASA>FTD mgmt

umeshunited — Wed, 09 Sep 2020 11:22:18 GMT

Unfortunately I do not have any PC in that LAN right now. I am trying to ping 10.10.0.60 from switch( to which it's mgmt is connected) but not able to ping.

If gateway is correct than I should be able to ping gateway and any device should be able to ping it.

I am trying to https it via mgmt IP from different subnet but no luck.

Re: Cisco ASA>FTD mgmt

umeshunited — Fri, 11 Sep 2020 14:47:36 GMT

I have connected laptop to inside interface. I can ping it but not https/ssh.

Moreover I see some cts config already present on it apart from

interface GigabitEthernet1/2
nameif inside
cts manual
propagate sgt preserve-untag
policy static sgt disabled trusted
security-level 100

ip address 192.168.1.1 255.255.255.0

Do I need to enable something from ftd?

Re: Cisco ASA>FTD mgmt

umeshunited — Fri, 11 Sep 2020 14:54:26 GMT

I have connected laptop to inside interface. I can ping it but not https/ssh.

Moreover I see some cts config already present on it apart from

interface GigabitEthernet1/2
nameif inside
cts manual
propagate sgt preserve-untag
policy static sgt disabled trusted
security-level 100

ip address 192.168.1.1 255.255.255.0

Do I need to enable something from ftd?

Re: Cisco ASA>FTD mgmt

umeshunited — Fri, 11 Sep 2020 17:17:03 GMT

I also tried adding network in "configure https-access-list...." and "configure ssh-access-list .... " but no luck.

Re: Cisco ASA>FTD mgmt

umeshunited — Wed, 16 Sep 2020 17:15:28 GMT

So here what helped me get access.

Configuration register was set as 0x41 so it was not loading default FTD configuration so mgmt interface was showing in admin down state. We changed it to 0x01 from ROMMON mode and now I was able to access it using mgmt interface IP address.