Management-Access in ASA

[fatalXerror]

Hi, anyone here experience to access their ASA firewall (ASDM/SSH) from the inside interface but the user is coming from outside interface of the ASA? I see some use cases using management-access but it uses VPN tunnel, can it be done without using a tunnel? Thanks

[balaji.bandi · Accepted solution]

if you like to give access outside, you can use below command :

http 0.0.0.0 0.0.0.0 outside  < this will allow any IP, you can mention granular with IP address known if any
ssh x.x.x.x y.y.y.y outside   < change IP and subnet

[fatalXerror]

Hi @balaji.bandi , but what if the customer does not want like access from outside interface but instead do it in inside interface, are there any way? We do not have any OOB network that's why I did not use the mgmt interface of the ASA. Thank you

[balaji.bandi]

You need to think other option like VPN coming in and manage ASA that is the option i can think of, or any Jump box for full controller IP to access Manangment access.

[Rob Ingram · Accepted solution]

Hi @fatalXerror 

You can only connect from the ASA's interface through to it's inside interface for management purposes (ssh, https, icmp) when coming via a VPN (RAVPN or L2L) if you have the "management-access <int>" command configured. In your scenario, without a VPN, this will not work.

HTH

[fatalXerror]

Hi @Rob Ingram , thank you for your feedback. Is there any other way for me to access via inside interface? thank you.

[Marius Gunnerud · Accepted solution]

To access the ASA via the inside interface you need to either be on the inside of the network (management traffic is entering the inside interface) or via a VPN.  You do not have any other option.

[fatalXerror]

Hi All, okay thank you so much for all of the help.

[Rob Ingram]

Setup Remote Access VPN, configure that command I provided and then you can manage the ASA on the inside interface.