Allow management interface to connect to evil internet?

[lonelyadmin]

I have a management network for most all of my gear which sits in the same network as the management interface on my asa 5516-X interface. It's basically a simply L3 vlan that all the management interfaces on servers, network gear, etc connect to. On every thing else, the management interface is on the mgmtVrf (or it's equivalent on non-Cisco gear). Some of the devices on that network need to get out to the outside interface for NTP, updates, etc. I cannot remove the management-only config on that interface. I do use that interface for ASDM and FP access.

How can I go about allowing certain traffic out the internet or DMZ from the Management interface/network on the ASA? I was thinking about creating transit network that my management network could use and then just use an inside interface on the ASA...but that just seems wrong to me.

[balaji.bandi]

it is possible but what is that certain traffic ? but management is only for OOB for best practice.

[lonelyadmin]

Some of the devices on the management network phone home to a vendor website for updates (which I can lock down via IP, port, protocol, etc.). They have no other interfaces available...I'd prefer to keep them as OOB as possible. If I can't allow some of the management/OOB devices out, I might look at just creating another management network that I'll isolate virtually as much as possible and allow it access out as needed.

[mkazam001]

the asa mgmt interface does not pass normal data traffic unless you use the int sub-cmd - no management-only.

hope that helps.

azam