ASA MGMT IP and FP Module IP address

[johnlloyd_13]

hi,

i saw an existing ASA 5525-X with FP and the MGMT and FP eth0 IP addresses were different.

The ASA MGMT IP has the 192.168.1.1/24 while FP has a 172.20.152.128/24 and ASA FP device was successfully added to FMC and a policy was applied.

my question is does the ASA MGMT and FP needs to be on the same subnet in order for FMC communication?

or can i leave the ASA MGMT blank and have the FP IP configured?

interface Management0/0
 management-only
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0

----------------------[ IPv4 ]----------------------
Conguration             : Manual
Address                   : 172.20.152.128
Netmask                   : 255.255.255.0
Broadcast                 : 172.20.152.255

[Marvin Rhoads · Accepted solution]

The ASA Management and FP module addresses are used for managing those respective fucntions. Think of them as analogous to two guest VMs in an ESXi host. You can elect to manage your ASA via another interface and thus leave the ASA management interface without any IP address.

The two don't intercommunicate but, if the ASA management interface has an address, it must be on the same subnet as the FirePOWER module address. This is because the interface does not support 802.1q trunking (that is, no tagging do distinguish between VLANs).

[johnlloyd_13]

hi marvin,

thanks! i have a lab 5525-x with FP and did a point-to-point to FTP PC and MGMT interface.

it does work if MGMT and FP are on different subnets.

another question, so it means now we need to patch the ASA MGMT port to a switch and configure the VLAN to which it will reach the FMC?

[Marvin Rhoads · Accepted solution]

Yes - if you do point to point they can be on different subnets. That would be a very unusal production setup though.

Correct - in production you would connect via a switch with the interface as an access port assigned to the VLAN associated with the configured subnet.

[johnlloyd_13]

hi marvin,

it was awkward when i saw the MGMT and FP IPs are on different subnets.

i was able to install the .pkg file directly from my FTP PC to ASA MGMT port.

i'll put the MGMT and FP IPs to be on same subnet so it wont' be confusing when another tech takes a look.

the previous admin (vendor/contractor) left the MGMT IP on192.168.1.1/24

i'll do the correct IP setup on my next FW projects.

[johnlloyd_13]

hi marvin,

another questions pop up, can i re-configure or run again the wizard to setup the SFR module? i initially want to use IPs for my lab and run the wizard and assign production IPs once the ASA+FP is ready for deployment. 

is this different from the 'setup' command?

asasfr-boot> setup

http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/118644-configure-firepower-00.html

ciscoasa# session sfr
Opening command session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
Sourcefire ASA5555 v5.3.1 (build 152)
Sourcefire3D login:

[Marvin Rhoads]

Running "setup" from the boot image prepares the unit for the full package. Once the package loads, you will then have to re-enter most of that in the first time autorun script as it is essentially a fresh OS at that point.

After you have a module fully configured and want to go back later and change addresses etc. you use the "configure network..." commands from the clish (that's the lightweight command line interface shell that runs on top of the Linux bash shell that you would see in expert mode).

Note that if you change the DNS value for the sfr module you need to restart the nscd daemon from expert mode (or else wait up to 24 hours for the cached entries to expire).

Pete Long has a good example in his blog posting here:

https://www.petenetlive.com/KB/Article/0001173

[johnlloyd_13]

thanks marvin!

i just got the SFR upgraded to 6.0.

i'll play with it first.

these upgrade steps are unpractical unlike CP and PA FWs.

will cisco fix or eliminate the SSD upgrade on the newer FP21xx/41xx?

MY-ASA# show module sfr details
Getting details from the Service Module, please wait...

Card Type:          FirePOWER Services Software Module
Model:              ASA5525
Hardware version:   N/A
Serial Number:      FCH1834Jxxx
Firmware version:   N/A
Software version:   6.0.0-1005
MAC Address Range:  fc5b.39aa.5162 to fc5b.39aa.xxx
App. name:          ASA FirePOWER
App. Status:        Up
App. Status Desc:   Normal Operation
App. version:       6.0.0-1005
Data Plane Status:  Up
Console session:    Ready
Status:             Up
DC addr:            No DC Configured                                            
Mgmt IP addr:       192.168.45.45                                               
Mgmt Network mask:  255.255.255.0                                               
Mgmt Gateway:       0.0.0.0                                                     
Mgmt web ports:     443                                                         
Mgmt TLS enabled:   true   

[Marvin Rhoads]

You're welcome.

On a new deployment, you are best off going all the way to the current release - 6.2.0 image with 6.2.0.2 patch would be the current one on that platform. Note if you are planning to use FMC, it must be at or above the managed device version.

FirePOWER appliances (2100, 4100 and 9300 series) don't run ASA with FirePOWER services. You can run an ASA image (logical device they call it) on the 4100 and 9300 series but there's no service module support.

FirePOWER Threat Defense (FTD) is the new unified image that runs on all three and you upgrade it in one operation - either from FirePOWER Device Manager (local web UI management) or FirePOWER Management Center.

[alaa_muneer2005]

Hi Marvin,

i have an issue with my ASA Mgmt Interface ,  i have tow ASA 5516-x configured as cluster and both ASA have SFR module so after configure SFR module i was not able to reach the mgmt ip of both ASA from outside mgmt subnet , why do you think happened ?