ASA Management on the outside interface from the inside

[jacques_henry696]

Hello,

Is it possible to manage (via the ASDM) my ASA from a *inside* LAN to the *outside* interface? I know this might sound crazy but believe me, I have good reasons.

Just to show you:

                                            inside if                    outside if

                                    (security level 0            security level 0

                                        10.0.0.254)                  11.0.0.254)

Admin Workstation  ------------------+------------ASA-----------+----------------

(10.0.0.1)

The following commands are enabled:

# same-security-traffic permit inter-interface

# http 10.0.0.0 255.0.0.0 inside

and the filtering rules are set to allow eveything.

However I cannot ping my outside interface from my workstation and the ASDM doesn't launch...

Any idea?

Thanks in advance!

[Maykol Rojas]

Hello Jacques,

No it is not possible. You are only able to access your directly connected interface because of security reasons. It is not configurable and it is by ASA design.

Cheers

Mike Rojas

[jacques_henry696]

Hi Mike,

Thanks for your answer. That's what I was afraid of...

I honestly do believe your word but as I have to justify my work can you redirect me to any cisco documentation I can refer to? I hope you won't take it the wrong way...

Thanks again!

[Maykol Rojas · Accepted solution]

Hello Jacques,

I understand, many customers ask the same question, unfortunately cisco only documented Ping, and it was on the command reference for ASA 7.0, check on the following:

"For  security purposes the security appliance does not support far-end  interface ping, that is pinging the IP address of the outside interface  from the inside network"

http://www.cisco.com/en/US/docs/security/asa/asa70/configuration/guide/trouble.html

If you have any other questions let me know.

Mike

[jacques_henry696]

That's what I was looking for!

Many thanks again!

Cheers