Hi,
We are using ASA 5525X..Configuration attached for your reference..Is it communication possible ASA and Firepower with following Ip 10.246.17.145 which is configured ASA out
sh run
: Saved
:
: Serial Number: FCH20457DE3
: Hardware: ASA5525, 8192 MB RAM, CPU Lynnfield 2394 MHz, 1 CPU (4 cores)
:
ASA Version 9.4(4)2
!
hostname citpl-dc-fw01a
enable password LmPAkL7AVu3jAHq3 encrypted
names
!
interface GigabitEthernet0/0
description *** Dcsw1-port 47 ***
channel-group 40 mode active
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/1
description *** Dcsw2-port 47 ***
channel-group 40 mode active
no nameif
no security-level
no ip address
<--- More --->
!
interface GigabitEthernet0/2
channel-group 10 mode active
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
channel-group 10 mode active
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/5
no nameif
no security-level
no ip address
!
<--- More --->
interface GigabitEthernet0/6
channel-group 42 mode active
!
interface GigabitEthernet0/7
channel-group 42 mode active
!
interface Management0/0
management-only
nameif management
security-level 100
no ip address
!
interface Port-channel10
lacp max-bundle 8
nameif ASA-OUT
security-level 0
ip address 10.246.17.145 255.255.255.248 standby 10.246.17.146
!
interface Port-channel40
lacp max-bundle 8
no nameif
no security-level
no ip address
!
<--- More --->
interface Port-channel40.31
description ** Hardware Manageemnt **
vlan 31
nameif HARDWARE-MGMT
security-level 100
ip address 10.246.17.1 255.255.255.192 standby 10.246.17.2
!
interface Port-channel40.50
description ** TOS-APP Server **
vlan 50
nameif TOS-APP
security-level 100
ip address 10.246.19.1 255.255.255.224 standby 10.246.19.2
!
interface Port-channel40.51
description ** TOS-DB Server **
vlan 51
nameif TOS-DB
security-level 100
ip address 10.246.19.33 255.255.255.224 standby 10.246.19.34
!
interface Port-channel40.52
description ** CORP-APP Server **
vlan 52
<--- More --->
nameif CORP-APP
security-level 100
ip address 10.246.19.65 255.255.255.224 standby 10.246.19.66
!
interface Port-channel40.53
description ** TEST-TOS Server **
vlan 53
nameif TEST-TOS
security-level 100
ip address 10.246.19.145 255.255.255.248 standby 10.246.19.146
!
interface Port-channel40.54
description **Vmotion **
vlan 54
nameif VMotion
security-level 100
ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2
!
interface Port-channel40.55
description ** HOST-MGMT Server **
vlan 55
nameif HOST-MGMT
security-level 100
ip address 10.246.19.161 255.255.255.240 standby 10.246.19.162
<--- More --->
!
interface Port-channel42
description LAN/STATE Failover Interface
lacp max-bundle 8
!
interface Port-channel48
no nameif
no security-level
no ip address
!
banner login WARNING:
banner login .
banner login ACCESS TO INFORMATION ON THIS MACHINE AND NETWORK IS RESTRICTED TO AUTHORISED
banner login PERSONNEL ONLY. ANY UNAUTHORISED USER IS SUBJECT TO CRIMINAL PROSECUTION
banner login UNDER THE COMPUTER MISUSE AND CYBERSECURITY ACT (CAP. 50A).
banner motd WARNING:
banner motd .
banner motd ACCESS TO INFORMATION ON THIS MACHINE AND NETWORK IS RESTRICTED TO AUTHORISED
banner motd PERSONNEL ONLY. ANY UNAUTHORISED USER IS SUBJECT TO CRIMINAL PROSECUTION
banner motd UNDER THE COMPUTER MISUSE AND CYBERSECURITY ACT (CAP. 50A).
banner asdm WARNING:
banner asdm ACCESS TO INFORMATION ON THIS MACHINE AND NETWORK IS RESTRICTED TO AUTHORISED PERSONNEL ONLY. ANY UNAUTHORISED USER IS SUBJECT TO CRIMINAL PROSECUTION UNDER THE COMPUTER MISUSE AND CYBERSECURITY ACT (CAP. 50A).
boot system disk0:/asa944-2-smp-k8.bin
ftp mode passive
<--- More --->
clock timezone IND 5 30
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list out-to-in extended permit ip any any log
access-list out-to-in extended permit icmp any any log
access-list tos-db extended permit ip any any
access-list tos-db extended permit icmp any any echo
access-list tos-db extended permit icmp any any echo-reply
pager lines 24
logging enable
logging timestamp
logging standby
logging buffer-size 32768
logging monitor debugging
logging buffered debugging
logging trap debugging
logging asdm informational
mtu HARDWARE-MGMT 1500
mtu TOS-APP 1500
mtu TOS-DB 1500
mtu CORP-APP 1500
mtu TEST-TOS 1500
mtu VMotion 1500
mtu HOST-MGMT 1500
<--- More --->
mtu management 1500
mtu ASA-OUT 1500
ip verify reverse-path interface management
ip verify reverse-path interface ASA-OUT
failover
failover lan unit primary
failover lan interface lanfail Port-channel42
failover link lanfail Port-channel42
failover interface ip lanfail 192.168.50.253 255.255.255.0 standby 192.168.50.254
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo management
icmp permit any echo-reply management
icmp permit any echo ASA-OUT
icmp permit any echo-reply ASA-OUT
asdm image disk0:/asdm-7221.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
access-group out-to-in in interface ASA-OUT
route ASA-OUT 0.0.0.0 0.0.0.0 10.246.17.147 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
<--- More --->
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
sysopt noproxyarp management
sysopt noproxyarp ASA-OUT
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh 10.246.17.0 255.255.255.192 HARDWARE-MGMT
ssh 10.246.17.144 255.255.255.248 ASA-OUT
ssh timeout 15
ssh version 2
ssh cipher encryption custom "aes256-ctr"
ssh cipher integrity custom "hmac-sha1"
ssh key-exchange group dh-group14-sha1
console timeout 15
management-access ASA-OUT
<--- More --->
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 10.246.17.147
ntp server 10.246.17.178
ssl cipher default custom "RC4-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
ssl cipher tlsv1 custom "RC4-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
ssl cipher dtlsv1 custom "RC4-SHA:AES128-SHA:AES256-SHA:DES-CBC3-SHA"
dynamic-access-policy-record DfltAccessPolicy
username citpl password Ez0Dc2.KSb9wc/P1 encrypted
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
<--- More --->
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect icmp error
!
service-policy global_policy global
prompt hostname context priority state
no call-home reporting anonymous
Cryptochecksum:42c7cfc286ac3bd532fc1058e01b5b3f
: end
