topic Re: Access ASDM from different interface in Network Security

Access ASDM from different interface

jensscheuvens — Wed, 24 May 2023 14:24:59 GMT

Hello together,

I am trying to access our ASA via ASDM from another Interface than the Management Interface.
I have multiple subinterfaces and I would like to access from one Host (Host A) behind Interface "test01" to the ASA via ASDM:

GigabitEthernet0/1.1
vlan 22
nameif test01
security-level 92
ip address 192.168.1.254 255.255.255.0

GigabitEthernet0/1.2
vlan 33
nameif test02
security level 95
ip address 192.168.2.254 255.255.255.0

If opening ASDM from Host A (192.168.1.5) and trying to connect to 192.168.2.254 it does not work.
In the logs I can see that the ASA in unable to locate the egress Interface. If simulating the traffic via packet tracer it
says "no route to host". But the interfaces are directly connected.

I have already tried to grant management access via:

http 192.168.1.5 255.255.255.255 test02

Am I missing here something or is this not possible?

ASA Version 9.12(4)47

ASDM Version 7.20(1)23

Thanks in advance

Re: Access ASDM from different interface

Rob Ingram — Wed, 24 May 2023 14:31:02 GMT

@jensscheuvens if you are connected behind test01 interface of the ASA you can only connect using SSH, HTTP (ASDM) etc to the closest interface (test01), not a far interface (test02) - thats' by design. The only exception to that if mgmt was over a VPN.

FYI, packet-tracer if for traffic "through" the ASA, not "to" the ASA so is not representative.

Re: Access ASDM from different interface

Flavio Miranda — Wed, 24 May 2023 14:30:51 GMT

Use http 0.0.0.0 0.0.0.0 test01

Re: Access ASDM from different interface

MHM Cisco World — Thu, 25 May 2023 08:40:07 GMT

check comment above

Re: Access ASDM from different interface

jensscheuvens — Wed, 24 May 2023 14:45:05 GMT

Thanks for your answer. It is the same when trying to access the device via SSH from 192.168.1.5 "failed to locate egress interface"

Re: Access ASDM from different interface

jensscheuvens — Wed, 24 May 2023 14:46:41 GMT

http 192.168.1.5 255.255.255.255 test01 <<- if you want to access via test01 subnet

Yes I would like to access from 192.168.1.5 via ASDM to 192.168.2.254.

I tested both but with the same result

Re: Access ASDM from different interface

MHM Cisco World — Wed, 24 May 2023 17:38:58 GMT

as @Rob Ingram mention there is two plane in ASA
DATA PLANE and MGMT PLANE

it separate so access via test01 for subnet of test02 is not pass through the DATA PLANE and access failed
you need to specify subnet that direct connect to interface use in command or use 0.0.0.0 (cisco not recommend this it risky)

Re: Access ASDM from different interface

Rob Ingram — Wed, 24 May 2023 14:56:34 GMT

@jensscheuvens but your configuration is incorrect if connecting from 192.168.1.5, the source interface is test01.

http 192.168.1.5 255.255.255.255 test01

...then connect to 129.168.1.254.

As I mentioned you cannot be connected behind test01 interface and connect to test02 interface.

Re: Access ASDM from different interface

MHM Cisco World — Thu, 25 May 2023 08:40:27 GMT

check above

Re: Access ASDM from different interface

Sheraz.Salim — Wed, 24 May 2023 15:01:21 GMT

This is the command you need to configure if you access from 192.168.1.5

asdm image flash:asdm-openjre-7xx-1xx.bin ! aaa authentication http console LOCAL aaa authorization exec LOCAL auto-enable aaa authentication login-history ! http server enable http server idle-timeout 60 https 192.168.1.5 255.255.255.255 test01

Re: Access ASDM from different interface

MHM Cisco World — Wed, 24 May 2023 15:04:32 GMT

His interface IP is .254 not .5
just want to notice you
thanks
MHM

Re: Access ASDM from different interface

jensscheuvens — Thu, 25 May 2023 07:25:28 GMT

Hi,

I have configured http 192.168.1.5 255.255.255.255 test01.
It was a mistake that I wrote above test02.

Ok thanks for your explanations and it is now clear to me.

One question which came to my mind yesterday:

If performing a NAT like:

SRC INT: test01
SRC: 192.168.1.5

DST INT: test02
SRC: 192.168.2.254

would that work?

Re: Access ASDM from different interface

Sheraz.Salim — Thu, 25 May 2023 08:35:40 GMT

192.168.2.254 is the IP address of test02 which is Firewall interface GigabitEthernet0/1.2.

unless you do something like this

object network Real-IP-test01

host 192.168.1.5

nat (test01,test02) source static Real-IP-test01 Interface

object network Real-IP2

host 192.168.2.100

nat(test01,test02) source static Real-IP-test01 Real-IP2

Re: Access ASDM from different interface

jensscheuvens — Thu, 25 May 2023 08:38:50 GMT

Thank you every one. The thread can be closed then

Re: Access ASDM from different interface

MHM Cisco World — Thu, 25 May 2023 08:40:44 GMT

You are so welcome