topic You can use the following in Network Security

Use Management Inferface as Inside interface

pradeep.kashyap — Tue, 12 Mar 2019 08:47:11 GMT

Hi Everyone,

I am facing an issue with my network traffic. The issue is my Firewall has 5 Interfaces

1 - Outside

2 - DMZ

3- Network A

4- Failver

5- management

nameif inside

security-level 100

ip address 10.10.10.1 255.255.255.0 standby 10.10.10.2

Now when i don't have Inside interface left, i configured Management as inside interface by giving nameif inside, and 100 security level,

but there is no traffic passing through it.. May i know what is left, how can we configure management interface as normal interface.

(I'm trying no management-only but its not working)

Thanks

ASA 5510 8.3(2)

Looks like you might need the

Rahul Govindan — Mon, 16 Jan 2017 20:11:54 GMT

Looks like you might need the security plus license to enable through traffic features for the mgmt interface. More details here:

https://supportforums.cisco.com/document/22211/management-interface-asa-does-not-allow-traffic-pass-through-it-and-asa-4-418001

Hi Rahul,

pradeep.kashyap — Mon, 16 Jan 2017 20:18:19 GMT

Hi Rahul,

Thanks for the reply, seems this is not the issue

##This platform has an ASA 5510 Security Plus license.

Can you paste the interface

Rahul Govindan — Mon, 16 Jan 2017 20:23:28 GMT

Can you paste the interface configuration? Also are you trying to send traffic from something connected on that interface? Could you apply a capture on the management interface to see if you see the traffic entering the ASA? Once you see traffic, run a packet-tracer to see what happens to the traffic sourced from that interface.

its pretty basic

pradeep.kashyap — Mon, 16 Jan 2017 20:40:26 GMT

its pretty basic

interface Management0/0

description "Inside/Management"
nameif inside
security-level 100
ip address 10.10.10.1 255.255.255.0 standby 10.10.10.2

On captures i can see incoming traffic on management interface but no reply from destination server on outside interface. (i suspect if traffic is even leaving the management interface)

Packet tracer results in all allow.

Can you capture traffic on

Rahul Govindan — Mon, 16 Jan 2017 21:03:37 GMT

Can you capture traffic on the outside interface and see if the traffic makes it through the ASA just to be sure ? Also any syslogs showing up when traffic fails?

In capture yes i can see

pradeep.kashyap — Tue, 17 Jan 2017 00:09:56 GMT

In capture yes i can see traffic on outside. yes it has traffic passing through. Is there any way to see traffic status reaching at firewalll and their processing.

You can use the following

Rahul Govindan — Tue, 17 Jan 2017 02:17:34 GMT

You can use the following command:

packet-tracer input inside tcp <inside-host> 12345 <outside-host> 80 detailed

If you are seeing packets sent from management interface host on the outside inside, then the management interface is working correctly. You might have to make sure it is hitting the right NAT rules to reach the internet.