1 Accepted Solution
Accepted Solutions
Hello Mohammed,
Could be a layer 2 problem.
Let me send you what needs to be done to make this happen:
Best practice for setup for IPS and ASA management
- IPS and ASA management cannot both be accessed through the Management 0/0 interface.
- No nameif is assigned to the ASA Management 0/0 interface. ASA management is accessed on traffic bearing interfaces.
- The IPS is given an IP address reachable from the “inside” nameif.
- Access from the “inside” occurs through either switching or routing, without involving the ASA.
- In order to allow management from the outside, create a static NAT translation for the sensor IP address or define port forwarding to the appropriate port (port redirection is used in this example).
In this scenario, the IPS management communications to the outside network behaves similar to any other host on the inside network. This is used for signature updates, Global Correlation and IPS Service License requests.
Configuration:
interface GigabitEthernet0/0 nameif outside security-level 0 ip address 192.168.3.1 255.255.0.0 ! interface GigabitEthernet0/1 nameif inside security-level 0 ip address 192.168.1.1 255.255.255.0 ! interface Management0/0 no nameif security-level 0 management-only ! same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network IPS-management host 192.168.1.2 object network ASA-inside host 192.168.1.1 object-group service HTTP service-object tcp-udp destination eq www service-object tcp destination eq https access-list global_access extended permit ip any any access-list global_access_1 remark Allow IPS management out through to the internet. access-list global_access_1 extended permit object-group HTTP object IPS-management any nat (inside,outside) source dynamic IPS-management IPS-management interface static (outside,inside) TCP 192.168.3.1 65432 192.168.1.2 https netmask 255.255.255.255 ! Use of an ephemeral port allows for the use of common ports for other network applications. This also conceals the actual management port by making it not well known. ASA# show module ips details | include Mgmt Mgmt IP addr: 192.168.1.2 Mgmt Network mask: 255.255.255.0 Mgmt Gateway: 192.168.1.1 Mgmt Access List: 0.0.0.0/0 Mgmt web ports: 443 Mgmt TLS enabled: true
Regards,
Hello Mohammed,
Could be a layer 2 problem.
Let me send you what needs to be done to make this happen:
Best practice for setup for IPS and ASA management
- IPS and ASA management cannot both be accessed through the Management 0/0 interface.
- No nameif is assigned to the ASA Management 0/0 interface. ASA management is accessed on traffic bearing interfaces.
- The IPS is given an IP address reachable from the “inside” nameif.
- Access from the “inside” occurs through either switching or routing, without involving the ASA.
- In order to allow management from the outside, create a static NAT translation for the sensor IP address or define port forwarding to the appropriate port (port redirection is used in this example).
In this scenario, the IPS management communications to the outside network behaves similar to any other host on the inside network. This is used for signature updates, Global Correlation and IPS Service License requests.
Configuration:
interface GigabitEthernet0/0 nameif outside security-level 0 ip address 192.168.3.1 255.255.0.0 ! interface GigabitEthernet0/1 nameif inside security-level 0 ip address 192.168.1.1 255.255.255.0 ! interface Management0/0 no nameif security-level 0 management-only ! same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network IPS-management host 192.168.1.2 object network ASA-inside host 192.168.1.1 object-group service HTTP service-object tcp-udp destination eq www service-object tcp destination eq https access-list global_access extended permit ip any any access-list global_access_1 remark Allow IPS management out through to the internet. access-list global_access_1 extended permit object-group HTTP object IPS-management any nat (inside,outside) source dynamic IPS-management IPS-management interface static (outside,inside) TCP 192.168.3.1 65432 192.168.1.2 https netmask 255.255.255.255 ! Use of an ephemeral port allows for the use of common ports for other network applications. This also conceals the actual management port by making it not well known. ASA# show module ips details | include Mgmt Mgmt IP addr: 192.168.1.2 Mgmt Network mask: 255.255.255.0 Mgmt Gateway: 192.168.1.1 Mgmt Access List: 0.0.0.0/0 Mgmt web ports: 443 Mgmt TLS enabled: true
Regards,
