topic Hello Rajesh, each component in Network Security

Management port for CMS and FMC

rajesh.mohapatra — Fri, 21 Feb 2020 13:53:27 GMT

Guys- I have procured some 5508-x device with firepower. To manage all these device I have procured CSM and FMC.

So Can I configure a single private IP to management interface and use both CSM and FMC?

If Yes, how can I proced further and if no please let me know the alternate solution.

Hello Rajesh, each component

nspasov — Wed, 10 Aug 2016 01:08:31 GMT

Hello Rajesh, each component (ASA and FirePOWER) will have their individual and unique IP addresses for management. Thus, the ASA's management IP will be referenced in CSM while FirePOWER's management IP address will be referenced in FMC.

I hope this helps!

Thank you for rating helpful posts!

Hi thanks for your info...

rajesh.mohapatra — Wed, 10 Aug 2016 10:38:08 GMT

Hi thanks for your info... here my question is we can assign IP address to management1/1 for CSM. and can we assign IP address for firepower service to mange from FMC ? and also could you please confirm both the IP we can use in same network or we need to use different network.

My answers below:

nspasov — Wed, 10 Aug 2016 16:00:55 GMT

My answers below:

- Yes, the ip address that you assign to the management interface on the ASA can be used for CSM

- The FirePOWER module gets its own IP address during the setup process. That IP address has to be on same subnet as your regular ASA data interface.

- The ASA uses a completely separate VRF table for traffic related to its management interface. No other traffic would be allowed on that VRF.

- Here is a link to the ASA with FirePOWER Quick Start Guide that explains a lot of this in detail:

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html

I hope this helps!

Thank you for rating helpful posts!

Are you working with

Marvin Rhoads — Wed, 10 Aug 2016 16:01:07 GMT

Are you working with @abushayeed1? He is asking very simialr quesiton which I answered:

https://supportforums.cisco.com/discussion/13093471/cisco-asa-5508-x-firepower-implementation-doubts

If you use the management interface for both, then the ASA and FirePOWER modules must use the same subnet. If you manage the ASA via another interface, it can use a different network. Cisco's recommendation is to use the management interface for both and thus both addresses are on the same network.

Like my friend Neno says. :)

Marvin Rhoads — Wed, 10 Aug 2016 16:03:51 GMT

Like my friend Neno says. 🙂

The separate management "VRF" is there as of ASA 9.5(1) or later.

Thank you for the endorsement

nspasov — Wed, 10 Aug 2016 21:05:51 GMT

Thank you for the endorsement sir!

Thank you Marvin and Neno for

rajesh.mohapatra — Thu, 11 Aug 2016 03:50:23 GMT

Thank you Marvin and Neno for your help and support. Yes me and abushayeed1 are working together for our set up.

thanks for your information,

resortthanhlam — Thu, 18 Aug 2016 04:56:11 GMT

thanks for your information, it is very useful to me