topic Re: Adding Additional Interfaces to Cisco ASAv in Network Security

Adding Additional Interfaces to Cisco ASAv

Garry Cooper — Tue, 20 Jun 2023 14:56:28 GMT

Need to add some additional interfaces to a pair of ASAv running on ESX. (Deleted the original ones when it was initially built)

After adding powering down the ASAv and then adding the interfaces, the ASA's boot but I do not get any network access.

The interfaces are there and the config looks correct, but I did notice that the http server enable had been stripped out ,so there may have been more missing and dont know why.

Has anyone successfully added additional interface to ASAv's or do I have to build some new ones with the interfaces.

Re: Adding Additional Interfaces to Cisco ASAv

Mark Elsen — Tue, 20 Jun 2023 17:16:00 GMT

- Ref : https://www.cisco.com/c/en/us/td/docs/security/asa/asa910/asav/quick-start-book/asav-910-qsg/asav_intro.html#id_45634 , also have a look at Table 5

Re: Adding Additional Interfaces to Cisco ASAv

MHM Cisco World — Tue, 20 Jun 2023 17:27:07 GMT

Use same interface but add more subinterface' can you do that ?

Re: Adding Additional Interfaces to Cisco ASAv

Garry Cooper — Wed, 21 Jun 2023 07:57:12 GMT

Thanks for the links but still not an answer that I need. but will look at the subinterface option.

Re: Adding Additional Interfaces to Cisco ASAv

Aref Alsouqi — Wed, 21 Jun 2023 09:59:42 GMT

Could you please share the sanitized configs for review?

Re: Adding Additional Interfaces to Cisco ASAv

Garry Cooper — Wed, 21 Jun 2023 13:25:09 GMT

!
interface GigabitEthernet0/0
nameif inside
security-level 100
ip address *.*.*.* 255.255.248.0 standby *.*.*.*
!
interface GigabitEthernet0/1
nameif outside
security-level 0
ip address *.*.*.* 255.255.255.0 standby *.*.*.*
policy-route route-map Default-Route-Inside
!
interface GigabitEthernet0/2
description LAN/STATE Failover Interface
!
interface Management0/0
no management-only
shutdown
nameif management
security-level 0
ip address *.*.*.* 255.255.255.0 standby *.*.*.*
!

Re: Adding Additional Interfaces to Cisco ASAv

MHM Cisco World — Wed, 21 Jun 2023 13:27:58 GMT

interface GigabitEthernet0/0
nameif inside
security-level 100
ip address *.*.*.* 255.255.248.0 standby *.*.*.*

divide this into multi subinterface

Re: Adding Additional Interfaces to Cisco ASAv

Aref Alsouqi — Wed, 21 Jun 2023 15:03:01 GMT

Could you please share the output of the command "sh int ip br"?

Re: Adding Additional Interfaces to Cisco ASAv

Garry Cooper — Thu, 22 Jun 2023 13:56:54 GMT

ncc-anyconnect# sh int ip br
Interface IP-Address OK? Method Status Protocol
GigabitEthernet0/0 *** YES CONFIG up up
GigabitEthernet0/1 **** YES CONFIG up up
GigabitEthernet0/2 192.168.1.1 YES unset up up
Internal-Data0/0 169.254.1.1 YES unset up up
Management0/0 *** YES CONFIG administratively down up
ncc-anyconnect#

Re: Adding Additional Interfaces to Cisco ASAv

Aref Alsouqi — Fri, 23 Jun 2023 16:11:05 GMT

Do you see anything on the ARP table? also, I assume you assinged the additional interface to the right port group on the ESXi?

Re: Adding Additional Interfaces to Cisco ASAv

Garry Cooper — Wed, 28 Jun 2023 07:08:52 GMT

I didnt check the arp table as I deliberately shutdown the interfaces.

Re: Adding Additional Interfaces to Cisco ASAv

Aref Alsouqi — Wed, 28 Jun 2023 12:38:16 GMT

If you bring up the interfaces do you see normal ARP entries? how the port group security settings are configured on the ESXi?