topic You're welcome. in Network Security

ASA MGMT IP and FP Module IP address

johnlloyd_13 — Tue, 12 Mar 2019 09:29:10 GMT

hi,

i saw an existing ASA 5525-X with FP and the MGMT and FP eth0 IP addresses were different.

The ASA MGMT IP has the 192.168.1.1/24 while FP has a 172.20.152.128/24 and ASA FP device was successfully added to FMC and a policy was applied.

my question is does the ASA MGMT and FP needs to be on the same subnet in order for FMC communication?

or can i leave the ASA MGMT blank and have the FP IP configured?

interface Management0/0
management-only
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0

----------------------[ IPv4 ]----------------------
Conguration             : Manual
Address                   : 172.20.152.128
Netmask                   : 255.255.255.0
Broadcast                 : 172.20.152.255

The ASA Management and FP

Marvin Rhoads — Fri, 09 Jun 2017 05:43:11 GMT

The ASA Management and FP module addresses are used for managing those respective fucntions. Think of them as analogous to two guest VMs in an ESXi host. You can elect to manage your ASA via another interface and thus leave the ASA management interface without any IP address.

The two don't intercommunicate but, if the ASA management interface has an address, it must be on the same subnet as the FirePOWER module address. This is because the interface does not support 802.1q trunking (that is, no tagging do distinguish between VLANs).

hi marvin,

johnlloyd_13 — Fri, 09 Jun 2017 05:48:36 GMT

hi marvin,

thanks! i have a lab 5525-x with FP and did a point-to-point to FTP PC and MGMT interface.

it does work if MGMT and FP are on different subnets.

another question, so it means now we need to patch the ASA MGMT port to a switch and configure the VLAN to which it will reach the FMC?

Yes - if you do point to

Marvin Rhoads — Fri, 09 Jun 2017 05:53:41 GMT

Yes - if you do point to point they can be on different subnets. That would be a very unusal production setup though.

Correct - in production you would connect via a switch with the interface as an access port assigned to the VLAN associated with the configured subnet.

hi marvin,

johnlloyd_13 — Fri, 09 Jun 2017 06:02:02 GMT

hi marvin,

it was awkward when i saw the MGMT and FP IPs are on different subnets.

i was able to install the .pkg file directly from my FTP PC to ASA MGMT port.

i'll put the MGMT and FP IPs to be on same subnet so it wont' be confusing when another tech takes a look.

the previous admin (vendor/contractor) left the MGMT IP on192.168.1.1/24

i'll do the correct IP setup on my next FW projects.

hi marvin,

johnlloyd_13 — Fri, 09 Jun 2017 06:17:07 GMT

hi marvin,

another questions pop up, can i re-configure or run again the wizard to setup the SFR module? i initially want to use IPs for my lab and run the wizard and assign production IPs once the ASA+FP is ready for deployment.

is this different from the 'setup' command?

asasfr-boot> setup

http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html

ciscoasa# session sfr
Opening command session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
Sourcefire ASA5555 v5.3.1 (build 152)
Sourcefire3D login:

Running "setup" from the boot

Marvin Rhoads — Fri, 09 Jun 2017 06:26:09 GMT

Running "setup" from the boot image prepares the unit for the full package. Once the package loads, you will then have to re-enter most of that in the first time autorun script as it is essentially a fresh OS at that point.

After you have a module fully configured and want to go back later and change addresses etc. you use the "configure network..." commands from the clish (that's the lightweight command line interface shell that runs on top of the Linux bash shell that you would see in expert mode).

Note that if you change the DNS value for the sfr module you need to restart the nscd daemon from expert mode (or else wait up to 24 hours for the cached entries to expire).

Pete Long has a good example in his blog posting here:

https://www.petenetlive.com/KB/Article/0001173

thanks marvin!

johnlloyd_13 — Fri, 09 Jun 2017 06:34:13 GMT

thanks marvin!

i just got the SFR upgraded to 6.0.

i'll play with it first.

these upgrade steps are unpractical unlike CP and PA FWs.

will cisco fix or eliminate the SSD upgrade on the newer FP21xx/41xx?

MY-ASA# show module sfr details
Getting details from the Service Module, please wait...

Card Type:          FirePOWER Services Software Module
Model:              ASA5525
Hardware version:   N/A
Serial Number:      FCH1834Jxxx
Firmware version:   N/A
Software version:   6.0.0-1005
MAC Address Range: fc5b.39aa.5162 to fc5b.39aa.xxx
App. name:          ASA FirePOWER
App. Status:        Up
App. Status Desc:   Normal Operation
App. version:       6.0.0-1005
Data Plane Status: Up
Console session:    Ready
Status:             Up
DC addr:            No DC Configured
Mgmt IP addr:       192.168.45.45
Mgmt Network mask: 255.255.255.0
Mgmt Gateway:       0.0.0.0
Mgmt web ports:     443
Mgmt TLS enabled:   true

You're welcome.

Marvin Rhoads — Fri, 09 Jun 2017 06:41:00 GMT

You're welcome.

On a new deployment, you are best off going all the way to the current release - 6.2.0 image with 6.2.0.2 patch would be the current one on that platform. Note if you are planning to use FMC, it must be at or above the managed device version.

FirePOWER appliances (2100, 4100 and 9300 series) don't run ASA with FirePOWER services. You can run an ASA image (logical device they call it) on the 4100 and 9300 series but there's no service module support.

FirePOWER Threat Defense (FTD) is the new unified image that runs on all three and you upgrade it in one operation - either from FirePOWER Device Manager (local web UI management) or FirePOWER Management Center.

Re: thanks marvin!

alaa_muneer2005 — Thu, 23 Nov 2017 18:19:04 GMT

Hi Marvin,

i have an issue with my ASA Mgmt Interface , i have tow ASA 5516-x configured as cluster and both ASA have SFR module so after configure SFR module i was not able to reach the mgmt ip of both ASA from outside mgmt subnet , why do you think happened ?