topic Cisco FTD 6.6.1 - VPN management access problem in Network Security

Cisco FTD 6.6.1 - VPN management access problem

mikiNet — Wed, 25 Nov 2020 14:23:07 GMT

Hi Guys,

I have FTD 6.6.1 with FDM, I configured Remote Access VPN, and everythink working good except for management FTD.

I would like to be able to manage this device after VPN connection. I configured one of data interfaces as a MGMT:

ftd1l# show nameif
Interface Name Security
Ethernet1/2.4 mgmt 0
Ethernet1/2.4 192.168.4.1

I configured management-access command via FlexConfig

ftd1l# sh run | i management
management-access mgmt

ftd1# sh run ssh
ssh 192.168.7.0 255.255.255.0 mgmt
ftd1# sh run http
http server enable
http 192.168.7.0 255.255.255.0 mgmt

nat (mgmt,outside) source static 192.168.4.0 192.168.4.0 destination static vpnpool vpnpool no-proxy-arp route-lookup

But I still can't access to FTD....

I have also SW on this subnet 192.168.4.0 with IP 192.168.4.200 and I able to connect it via SSH...

What is wrong on FTD ?

Re: Cisco FTD 6.6.1 - VPN management access problem

Marvin Rhoads — Thu, 26 Nov 2020 12:16:48 GMT

Is the VPN configured to either be full tunnel or, if split tunnel. include the management subnet?

Re: Cisco FTD 6.6.1 - VPN management access problem

mikiNet — Thu, 26 Nov 2020 18:20:42 GMT

Split tunnel include the management subnet. As I mentioned, any other device in management subnet are accesible via VPN

Re: Cisco FTD 6.6.1 - VPN management access problem

mikiNet — Mon, 30 Nov 2020 13:45:00 GMT

This is a BUG in software FDM 😞

Below answer from Cisco Engineer:

After I have check internally and found that unfortunately it's still not supported to enable manage the device through AnyConnect to the inside interface, there is already a bug has been opened to address this issue:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt73926

Please refer the below workarounds:

Connect and internal computer/server then access the FTD, and this computer/server needs to be added to the encryption domain for the VPN tunnel (such as when we SSH the FTD from the internal switch).
Manage the FDM through the outside interface. SSH/SNMP/HTTPS will be done through the outside interface.
you might consider using FMC to manage the FTD, as FMC has more options and more flexibility to manage the FTD since it's considered a separate device.

Re: Cisco FTD 6.6.1 - VPN management access problem

Marvin Rhoads — Mon, 30 Nov 2020 13:55:08 GMT

Good info. Thanks for sharing the BugID.

Re: Cisco FTD 6.6.1 - VPN management access problem

Alex Ziegelschmied — Thu, 02 Mar 2023 13:26:27 GMT

A BUG which is still not fixed yet... interesting. 🙂