topic Management-Access in ASA in Network Security

Management-Access in ASA

fatalXerror — Fri, 18 Sep 2020 10:27:29 GMT

Hi, anyone here experience to access their ASA firewall (ASDM/SSH) from the inside interface but the user is coming from outside interface of the ASA? I see some use cases using management-access but it uses VPN tunnel, can it be done without using a tunnel? Thanks

Re: Management-Access in ASA

balaji.bandi — Fri, 18 Sep 2020 15:46:36 GMT

if you like to give access outside, you can use below command :

http 0.0.0.0 0.0.0.0 outside  < this will allow any IP, you can mention granular with IP address known if any
ssh x.x.x.x y.y.y.y outside   < change IP and subnet

Re: Management-Access in ASA

Rob Ingram — Fri, 18 Sep 2020 16:40:52 GMT

Hi @fatalXerror

You can only connect from the ASA's interface through to it's inside interface for management purposes (ssh, https, icmp) when coming via a VPN (RAVPN or L2L) if you have the "management-access <int>" command configured. In your scenario, without a VPN, this will not work.

HTH

Re: Management-Access in ASA

fatalXerror — Mon, 21 Sep 2020 11:49:32 GMT

Hi @balaji.bandi , but what if the customer does not want like access from outside interface but instead do it in inside interface, are there any way? We do not have any OOB network that's why I did not use the mgmt interface of the ASA. Thank you

Re: Management-Access in ASA

fatalXerror — Mon, 21 Sep 2020 11:50:26 GMT

Hi @Rob Ingram , thank you for your feedback. Is there any other way for me to access via inside interface? thank you.

Re: Management-Access in ASA

Rob Ingram — Mon, 21 Sep 2020 11:52:38 GMT

Setup Remote Access VPN, configure that command I provided and then you can manage the ASA on the inside interface.

Re: Management-Access in ASA

Marius Gunnerud — Mon, 21 Sep 2020 11:54:16 GMT

To access the ASA via the inside interface you need to either be on the inside of the network (management traffic is entering the inside interface) or via a VPN. You do not have any other option.

Re: Management-Access in ASA

fatalXerror — Mon, 21 Sep 2020 12:11:25 GMT

Hi All, okay thank you so much for all of the help.

Re: Management-Access in ASA

balaji.bandi — Mon, 21 Sep 2020 12:37:04 GMT

You need to think other option like VPN coming in and manage ASA that is the option i can think of, or any Jump box for full controller IP to access Manangment access.