topic Thank You, in Network Security

ASA Firewall MGMT interface Setup and Access Issue

avilt — Fri, 21 Feb 2020 13:37:20 GMT

I have SETUP ASA 5525-X firewalls in a active standby HA pair. It's inside interface (Gi0/0) is terminated on L3 switch (vlan30), firewall will use L3 switch to reach all the inside segments.

On the inside network we have vlan's for DATA (vlan10), MGMT(vlan20) and INSIDE(vlan30).

The firewall MGMT interface (Gi0/7 which is used for management only) is also terminated in the MGMT vlan on L2 switch.

Now I have my server in the DATA vlan which is unable to ping the MGMT interface of the firewalls.

This is not an ACL issue, my guess is that, the ping request from server to MGMT interface will reach the MGMT interface but the reply will return thru inside interface of the firewall. How can I resolve this issue?

Please refer the attached network diagram for more info.

Hello Avilt,

Ganesh Hariharan — Mon, 30 Nov 2015 04:02:11 GMT

Hello Avilt,

MGMT interface are bound with separate VRF in ASA, You can only reach MGMT interface via MGMT vlan or either try to drop a default route in MGMT VRF towards MGMT SVI and then check.

Hope it Helps..

-GI

Ganesh - separate management

Marvin Rhoads — Mon, 30 Nov 2015 16:28:10 GMT

Ganesh - separate management VRF is a very new feature only available as of ASA 9.5 software. Reference.

Aviit - any ASA prior to 9.5 uses a single global routing table. Accessing the management interface from any host not on the management subnet would require the "best" (ie. lowest administrative distance and/or most specific match) route be hard coded to the management interface.

This is often impractical unless you have a dedicated management subnet and all hosts needing to manage the ASA reside on that subnet. For this reason, many customers simply use the inside interface for management.

Thank You,

QUARK TARO — Mon, 30 Nov 2015 16:47:01 GMT

Thank You,

In the above setup I have assigned SFR IP address as 192.168.1.4 (active) & 192.168.1.5 (standby).

Now when I ping from the server 172.16.0.10 to 192.168.1.4, how does the traffic reach to it?

When I do a tracert I see the 2nd hop as 10.10.10.1

You didn't initially mention

Marvin Rhoads — Mon, 30 Nov 2015 17:00:57 GMT

You didn't initially mention using the sfr (FirePOWER Service module).

The sfr essentially runs as a separate "VM" on the ASA. As such, it has its own dedicated default gateway set. It shares the physical management interface with the ASA software. You can use that physical interface for sfr management only and manage the ASA via its inside interface.

Your core L3 switch should have an interface on the VLAN associated with 192.168.1.x so that it knows there's a connected route for that subnet. (Connected routes have the least cost, all other things being equal.)

In the above diagram, the

QUARK TARO — Mon, 30 Nov 2015 17:30:30 GMT

In the above diagram, the MGMT interface Gi0/7 is defined as management only with IP address 192.168.1.1/24

Now the SFR IP address is 192.168.1.4/24 and Firesight IP is 192.168.1.3/24

But I am using the firewall inside interface 10.10.10.1 for ASDM management.

Now Am I right in saying Firesight reaches SFR thru MGMT interface?

Yes - FireSIGHT / FirePOWER

Marvin Rhoads — Mon, 30 Nov 2015 17:41:06 GMT

Yes - FireSIGHT / FirePOWER Management Center communicates with the sfr module via the ASA management interface only.

However, it must be the ASA's dedicated management interface - Management 0/0.

You cannot use any other interface for sfr module communications to its manager - even ones that you have defined as "management only" in the ASA configuration.

Thanks Marvin for

Ganesh Hariharan — Tue, 01 Dec 2015 15:56:30 GMT

Thanks Marvin for clarification , My mistake ..You are right we implemented in latest relase n our DC ..

-GI