topic Re: ASA INITIAL SETUP in Network Security

ASA INITIAL SETUP

fmugambi — Wed, 15 May 2024 07:33:19 GMT

Hello Guys,

Am setting up cisco asa 5555x, needed help with mgmt setup and be able to ssh from a different subnet.

have configured mgmt interface, give security level 100, /24 mgmt subnet. it can pick its default g/w but nothing else outside the g/w.

what would i be missing?

Re: ASA INITIAL SETUP

MHM Cisco World — Wed, 15 May 2024 07:36:38 GMT

Management-access interface OUT

I think this what ypu need to access ASA via SSH from OUT

Also make sure you specify subnet

Ssh x.x.x.x x.x.x.x OUT

Re: ASA INITIAL SETUP

fmugambi — Wed, 15 May 2024 07:49:23 GMT

so no acl, no mgmt vrfs?

Re: ASA INITIAL SETUP

MHM Cisco World — Wed, 15 May 2024 08:03:08 GMT

Sorry I dont get your Q' can you more elaborate

MHM

Re: ASA INITIAL SETUP

Marvin Rhoads — Wed, 15 May 2024 08:16:56 GMT

Do you have a "route management" statement telling the management interface what gateway to use?

Also, you you have an "ssh " statement allowing the remote subnet(s) to access the device?

Re: ASA INITIAL SETUP

fmugambi — Wed, 15 May 2024 08:34:16 GMT

yes i do, a route, with mgmt subnet and its g/w as next hop.

ssh statements are there too.

Re: ASA INITIAL SETUP

MHM Cisco World — Wed, 15 May 2024 08:37:23 GMT

above what I mention only what you need

MHM

Re: ASA INITIAL SETUP

fmugambi — Wed, 15 May 2024 08:41:11 GMT

done this, but still no joy. not able to ssh.

Re: ASA INITIAL SETUP

fmugambi — Wed, 15 May 2024 08:43:21 GMT

was concerned since the mgmt subnet is say 192.168.100.0/24 and my laptop is on 10.189.10.100.

connectivity is already there cause i can manage other devices on 192.168.100.0/24 network. this new asa setup is what is abit challenging.

cant seem to see what am missing.

Re: ASA INITIAL SETUP

MHM Cisco World — Wed, 15 May 2024 08:46:54 GMT

if you can ping the ASA interface from the laptop (interface direct connect not mgmt interface) then

ssh 10.189.10.x 255.255.255.0 <interface X>

this interface X use in management-access interface x

Re: ASA INITIAL SETUP

fmugambi — Wed, 15 May 2024 08:58:30 GMT

this is where my problems begin, cause am not able to ping the mgmt interface.

Re: ASA INITIAL SETUP

MHM Cisco World — Wed, 15 May 2024 09:00:25 GMT

you can not ping mgmt interface by device connect to other interface of ASA

that why we need to use management-interface to make interface work as mgmt interface and data interface.
try ping from laptop to interface direct connect not to mgmt interface

MHM

Re: ASA INITIAL SETUP

fmugambi — Wed, 15 May 2024 09:07:53 GMT

this is how topology is.

so do you mean i use a different physical interface, say g0/7 rather than mgmt interface?

Re: ASA INITIAL SETUP

MHM Cisco World — Wed, 15 May 2024 09:35:32 GMT

the R3 do intervlan for the interwork and I success ping from PC 100.0.0.10 to mgmt 10.0.0.10
just you need route mgmt <PC subnet> <mgmt IP in L3 device that do inter vlan>

MHM