topic Re: Unable to access ASA via Managment Interface in Network Security

Unable to access ASA via Managment Interface

Chts — Fri, 21 Feb 2020 15:56:46 GMT

I have deployed ASA on Firepower 4100 series Chassis, configured one of the data interface as a management interface with an IP address. I have connected a laptop directly to the management interface try to ping - unable to ping. Global policy is inspecting icmp.

sh run int et1/5
!
interface Ethernet1/5
management-only
nameif management
security-level 100

ip address 10.10.10.3 255.255.255.0

on the logs the following I see.. I have not enabled ipv6 under management interface as you see above but

%ASA-6-302021: Teardown ICMP connection for faddr ff02::1/0 gaddr fe80::200:ff:fe01:3/0 laddr fe80::200:ff:fe01:3/0 type 134 code 0

Anyone experienced this?

Re: Unable to access ASA via Managment Interface

Rahul Govindan — Wed, 04 Jul 2018 12:49:47 GMT

These look like Neighbour discovery messages for ICMPv6. Hosts automatically sent solicitation and advertisement messages to peers in a link. Is your machine IPv6 enabled? This could be when it tries to send to the link local address of its peer.

Re: Unable to access ASA via Managment Interface

Chts — Wed, 04 Jul 2018 20:27:17 GMT

Hi Rahul,

Thanks for the reply.

My machine(laptop) is not enable with ipv6, I have assigned ipv4 address to the management interface where I have connected my laptop directly with the same subnet of IP address and tried pinging management ip, not responding.

Re: Unable to access ASA via Managment Interface

balaji.bandi — Wed, 04 Jul 2018 21:42:25 GMT

This looks like suspicious for me, have you connected console and able to ping locally in the 4100 and check the interface status, when you connected laptop.

Re: Unable to access ASA via Managment Interface

Chts — Thu, 05 Jul 2018 12:37:16 GMT

I have. On the Chassis, the management interface(one of the data interface change type to mgmt.) allocated for ASA is up and inside ASA interface status showing up and up. but when I connect my laptop directly to that interface with the same subnet IP not able to ping in any direction.

Re: Unable to access ASA via Managment Interface

aaron.hackney — Fri, 06 Jul 2018 00:06:28 GMT

It is possible there is a policy preventing ICMP.

1. Have you added your laptop IP to the SSH/HTTP allow lists on that interface and tried SSH/HTTPS?

2. Have you tried issuing a packet-tracer on this port with ICMP and/or SSH/HTTPS? What were the results?

-A