Ok now I understand. No you can't assign IP on 5555-X MGMT interface is you
are using SFR module. This is listed by Cisco. See this doc.
https://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.htmlQuoted:
ASA 5506-X (9.6 and Earlier) through ASA 5555-X (Software Module) in Routed
Mode
These models run the ASA FirePOWER module as a software module, and the ASA
FirePOWER module shares the Management 0/0 or Management 1/1 interface
(depending on your model) with the ASA.
All management traffic to and from the ASA FirePOWER module must enter and
exit the Management interface. The ASA FirePOWER module also needs Internet
access. Management traffic cannot pass through the ASA over the backplane;
therefore you need to physically cable the management interface to an ASA
interface to reach the Internet.
If you do not configure a name and IP address in the ASA configuration for
Management, then the interface belongs exclusively to the module. In this
case, the Management interface is not a regular ASA interface, and you can:
*1.* <> Configure
the ASA FirePOWER IP address to be on the same network as a regular ASA
data interface.
*2.* <> Specify
the data interface as the ASA FirePOWER gateway.
*3.* <> Directly
connect the Management interface to the data interface (using a Layer2
switch).
See the following typical cabling setup to allow ASA FirePOWER access to
the Internet through the ASA inside interface:
<>
For the ASA 5506-X on 9.6 and earlier, the ASA 5508-X, and the ASA 5516-X,
the default configuration enables the above network deployment; the only
change you need to make is to set the module IP address to be on the same
network as the ASA inside interface and to configure the module gateway IP
address.
For other models, you must remove the ASA-configured name and IP address
for Management 0/0 or 1/1, and then configure the other interfaces as
indicated above.
*Note* <>: For
ASA 9.7 and later, you can avoid using an external switch if you have extra
interfaces that you can assign to an inside bridge group. Be sure to set
all bridge group interfaces to the same security level, allow same security
communication, and configure NAT for each bridge group member. See the ASA
interfaces configuration guide chapter for more information.
*Note* <>: If you
want to deploy a separate router on the inside network, then you can route
between management and inside. In this case, you can manage both the ASA
and ASA FirePOWER module on the Management interface with the appropriate
configuration changes, including configuring the ASA name and IP address
for the Management interface (on the same network as the ASA FirePOWER
module address).
