topic @GRANT3779 , in Network Security

Unable to Ping FirePOWER module

GRANT3779 — Sun, 10 Mar 2019 13:50:04 GMT

I have what must be a simple issue...

Setup is per attached. I am unable to ping the FirePOWER address from anywhere (except from the physical ASA itself).

My L3 Switch is the DG.

Some details from the FP module

----------------------[ eth0 ]----------------------
Physical Interface : eth0
Type : Management
Status : Enabled
MDI/MDIX : Auto
MTU : 1500
MAC Address : 00:D7:8F:F6:DB:AC
IPv4 Address : 10.7.225.99

eth0 Link encap:Ethernet HWaddr 00:D7:8F:F6:DB:AC
inet addr:10.7.225.99 Bcast:10.7.225.255 Mask:255.255.255.0
inet6 addr: fe80::2d7:8fff:fef6:dbac/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:136 errors:0 dropped:0 overruns:0 frame:0
TX packets:1634 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:9616 (9.3 Kb) TX bytes:88297 (86.2 Kb)

> show route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.7.225.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
127.0.0. 0 0.0.0.0 255.255.0.0 U 0 0 0 cplane
0.0.0.0 10.7.225.1 0.0.0.0 UG 0 0 0 eth0

I am sure the cabling/design for Management is supported from the deployment guides I have looked at.

On Firepower module change

singhkulbir29881 — Tue, 02 May 2017 18:38:10 GMT

On Firepower module change the default gateway to ASA management interface IP and ensure that you are inspecting the icmp traffic. By default, ASA is not inspecting ICMP traffic.

Are to able to configure Firepower module using ASDM ?

According to the guide

GRANT3779 — Tue, 02 May 2017 18:56:55 GMT

According to the guide

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html

I should be able to point to a L3 interface.

This is a setup I have with other ASAs, only difference being this is a 5506. Others have been ASAs with added SSD.

Your setup indeed appears

Marvin Rhoads — Wed, 03 May 2017 05:37:58 GMT

Your setup indeed appears correct per the guides and what I have seen working in other deployments.

I'd check the switchport and make sure there's no restriction such as port security.

Are you getting arp cache entries at each end (i.e., on the switch for .99 and module for .1)?

@Marvin,

GRANT3779 — Wed, 03 May 2017 08:06:45 GMT

@Marvin,

I knew there was switch port security on the port (allowing 2 MACS) and did check the status yesterday which looked good... Anyways, I just removed Port Security, brought port down and up. Now all is good in the world!

Thanks for the nudge..

@GRANT3779 ,

Marvin Rhoads — Wed, 03 May 2017 09:25:46 GMT

GRANT3779 ,

You're welcome. Thanks for the rating.

I got lucky on my first guess today. 🙂