ASA 5508 and 5516 with Firepower module

[Mark Bowyer]

Hi,

I am new to Firepower. We have FMC and I have added both firewalls to it. From what I can see, I can only configure certain things using the Firepower module, the interface IP's etc, I had to configure on the ASA part of the firewall. My question is relating to the security policies, NAT and network objects etc. Should all of those be configured on the firepower module or on the ASA?

Thanks,

Mark

[Marvin Rhoads]

For ASAs running ASAA image plus the separate Firepower service module, all of the classic ASA ACLs, NAT rules etc. continue to be configured on the ASA itself (using cli or ASDM or CSM etc.).

Only when you change to an ASA running Firepower Threat Defense (FTD) unified image would you configure all of that in your FMC (or FDM/CDO if you were to use those management types).

[Mark Bowyer]

When I SSH to the 5516, it takes me into the ASA CLI. The ASA IOS is asa982-lfbff-k8.SPA. When I switch to the Firepower module, its running Cisco Fire Linux OS v6.2.2 (build 11).

When I SSH to the 5508, it takes me straight into the Firepower module for some reason and I dont seem to be able to switch to the ASA, it will not connect via ASDM either. Its also running Cisco Fire Linux OS v6.2.2 (build 11).

Are these particular ones supposed to be managed via ASDM or FMC? and if they are managed on ASDM, what is the Firepower module used for?

[babiojd01]

Console in with a cable and review your ssh statements on the ASA. The only reason the FP module would respond to the ssh request is if you have the IP assigned when you setup the module.

[Marvin Rhoads]

Do you have the part number that was ordered on your 5508? It is possible it was ordered with the FTD image.

Or, as @babiojd01 suggested,console in and share the output ("show version").

[Mark Bowyer]

I cant get into the ASA side on the 5508, but here is the sh version from the 5516:

Cisco Adaptive Security Appliance Software Version 9.8(2)
Firepower Extensible Operating System Version 2.2(2.52)
Device Manager Version 7.8(2)

Compiled on Sun 27-Aug-17 13:06 PDT by builders
System image file is "disk0:/asa982-lfbff-k8.SPA"
Config file at boot was "startup-config"

31FHQ-Cisco5516-conf up 16 days 22 hours

Hardware: ASA5516, 8192 MB RAM, CPU Atom C2000 series 2416 MHz, 1 CPU (8 cores)
Internal ATA Compact Flash, 8000MB
BIOS Flash M25P64 @ 0xfed01000, 16384KB

Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
Number of accelerators: 1

1: Ext: GigabitEthernet1/1 : address is 7488.bb67.6298, irq 255
2: Ext: GigabitEthernet1/2 : address is 7488.bb67.6299, irq 255
3: Ext: GigabitEthernet1/3 : address is 7488.bb67.629a, irq 255
4: Ext: GigabitEthernet1/4 : address is 7488.bb67.629b, irq 255
5: Ext: GigabitEthernet1/5 : address is 7488.bb67.629c, irq 255
6: Ext: GigabitEthernet1/6 : address is 7488.bb67.629d, irq 255
7: Ext: GigabitEthernet1/7 : address is 7488.bb67.629e, irq 255
8: Ext: GigabitEthernet1/8 : address is 7488.bb67.629f, irq 255
9: Int: Internal-Data1/1 : address is 7488.bb67.6297, irq 255
10: Int: Internal-Data1/2 : address is 0000.0001.0002, irq 0
11: Int: Internal-Control1/1 : address is 0000.0001.0001, irq 0
12: Int: Internal-Data1/3 : address is 0000.0001.0003, irq 0
13: Ext: Management1/1 : address is 7488.bb67.6297, irq 0
14: Int: Internal-Data1/4 : address is 0000.0100.0001, irq 0

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 150 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 2 perpetual
Carrier : Disabled perpetual
AnyConnect Premium Peers : 4 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 300 perpetual
Total VPN Peers : 300 perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
Shared License : Disabled perpetual
Total TLS Proxy Sessions : 1000 perpetual
Botnet Traffic Filter : Disabled perpetual
Cluster : Enabled perpetual
Cluster Members : 2 perpetual
VPN Load Balancing : Enabled perpetual

Serial Number: JAD23020460
Running Permanent Activation Key: 0xf83cee67 0x0c1ac47e 0x6090ed68 0xb6048468 0x4f3b16a7
Configuration register is 0x1
Image type : Release
Key Version : A
Configuration last modified by enable_15 at 12:06:34.008 UTC Mon Jan 20 2020

[Mark Bowyer]

Has anyone got any ideas?

[Marvin Rhoads]

What do you get "show version" when you console into the 5508?

[Mark Bowyer]

I got a bit further with the 5508. I couldnt access the ASA CLI before, but I wiped it and put the config back on and now I can. Here is the output of sh ver:

Cisco Adaptive Security Appliance Software Version 9.8(2)
Firepower Extensible Operating System Version 2.2(2.52)
Device Manager Version 7.8(2)

Compiled on Sun 27-Aug-17 13:06 PDT by builders
System image file is "disk0:/asa982-lfbff-k8.SPA"
Config file at boot was "startup-config"

31FHQ-Cisco5508-conf up 3 days 19 hours

Hardware: ASA5508, 8192 MB RAM, CPU Atom C2000 series 2000 MHz, 1 CPU (8 cores)
Internal ATA Compact Flash, 8000MB
BIOS Flash M25P64 @ 0xfed01000, 16384KB

Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
Number of accelerators: 1

1: Ext: GigabitEthernet1/1 : address is 6c8b.d387.7d5e, irq 255
2: Ext: GigabitEthernet1/2 : address is 6c8b.d387.7d5f, irq 255
3: Ext: GigabitEthernet1/3 : address is 6c8b.d387.7d60, irq 255
4: Ext: GigabitEthernet1/4 : address is 6c8b.d387.7d61, irq 255
5: Ext: GigabitEthernet1/5 : address is 6c8b.d387.7d62, irq 255
6: Ext: GigabitEthernet1/6 : address is 6c8b.d387.7d63, irq 255
7: Ext: GigabitEthernet1/7 : address is 6c8b.d387.7d64, irq 255
8: Ext: GigabitEthernet1/8 : address is 6c8b.d387.7d65, irq 255
9: Int: Internal-Data1/1 : address is 6c8b.d387.7d5d, irq 255
10: Int: Internal-Data1/2 : address is 0000.0001.0002, irq 0
11: Int: Internal-Control1/1 : address is 0000.0001.0001, irq 0
12: Int: Internal-Data1/3 : address is 0000.0001.0003, irq 0
13: Ext: Management1/1 : address is 6c8b.d387.7d5d, irq 0
14: Int: Internal-Data1/4 : address is 0000.0100.0001, irq 0

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 50 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 2 perpetual
Carrier : Disabled perpetual
AnyConnect Premium Peers : 4 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 100 perpetual
Total VPN Peers : 100 perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
Shared License : Disabled perpetual
Total TLS Proxy Sessions : 320 perpetual
Botnet Traffic Filter : Disabled perpetual
Cluster : Disabled perpetual
VPN Load Balancing : Enabled perpetual

Serial Number: JAD231315F8
Running Permanent Activation Key: 0xdc1fd049 0x882ed21f 0x14a22168 0xb0d4ac30 0x0b1d2ba4
Configuration register is 0x1
Image type : Release
Key Version : A
Configuration last modified by enable_15 at 10:58:08.718 UTC Fri Feb 21 2020

The only problem now is that although I can access the ASA CLI, I still cant access it via ASDM for some reason.

[Marvin Rhoads · Accepted solution]

Since you've reimaged the ASA, have you loaded an ASDM image (bin file) onto disk and specified it in the configuration?

Have you further enabled the http server and specified the allowed subnets for management and the interfaces on which their traffic is expected?

You have the 3DES-AES license so that's good.

[Mark Bowyer]

I just erased the startup config. It looks like the asdm bin is still on there:

--#-- --length-- -----date/time------ path
94 108563072 Apr 04 2019 22:13:24 asa982-lfbff-k8.SPA
95 26970456 Apr 04 2019 22:13:44 asdm-782.bin
96 33 Feb 21 2020 10:59:50 .boot_string
11 4096 Apr 04 2019 22:17:06 log
13 625 Feb 20 2020 15:27:55 log/asa-appagent.log
21 4096 Apr 04 2019 22:17:58 crypto_archive
22 4096 Apr 04 2019 22:18:00 coredumpinfo
23 59 Apr 04 2019 22:18:00 coredumpinfo/coredump.cfg

Here is the config, there isnt much on there, I was just setting up management etc when I hit the problem:

ASA Version 9.8(2)
!
hostname 31FHQ-Cisco5508-conf
enable password $sha512$5000$iSBToXnq/qBAqN3s8mNENw==$BVpoN9TGuabVVDgXi0dzxQ== pbkdf2
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names

!
interface GigabitEthernet1/1
shutdown
nameif outside
security-level 0
no ip address
!
interface GigabitEthernet1/2
shutdown
nameif inside
security-level 100
no ip address
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
nameif ManageASDM
security-level 100
ip address 10.222.102.251 255.255.255.0
!
ftp mode passive
pager lines 24
mtu ManageASDM 1500
mtu outside 1500
mtu inside 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
route ManageASDM 10.128.18.63 255.255.255.255 10.222.102.254 1
route ManageASDM 10.152.16.49 255.255.255.255 10.222.102.254 1
route ManageASDM 10.222.92.0 255.255.255.0 10.222.102.254 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication login-history
http server enable
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet 10.222.92.0 255.255.255.0 ManageASDM
telnet timeout 30
ssh stricthostkeycheck
ssh 10.222.92.0 255.255.255.0 ManageASDM
ssh 10.152.16.49 255.255.255.255 ManageASDM
ssh timeout 30
ssh version 2
ssh key-exchange group dh-group14-sha1
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
username admin password $sha512$5000$QhYpvFQFA4gKLpMuuEadqQ==$gx6BcwJUxdXIu1B1HSOK8A== pbkdf2
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect dns preset_dns_map
policy-map type inspect dns migrated_dns_map_2
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous prompt 2
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:a59fb808e7cd18d6422902f5a068493b
: end

[Mark Bowyer]

It turned out that it was missing this line:

http 10.222.92.0 255.255.255.0 ManageASDM

Thanks very much for your help!

[Marvin Rhoads]

You're welcome. Thanks for rating.