Unable to Ping FirePOWER module

[GRANT3779]

I have what must be a simple issue...

Setup is per attached. I am unable to ping the FirePOWER address from anywhere (except from the physical ASA itself).

My L3 Switch is the DG.

Some details from the FP module

----------------------[ eth0 ]----------------------
Physical Interface : eth0
Type : Management
Status : Enabled
MDI/MDIX : Auto
MTU : 1500
MAC Address : 00:D7:8F:F6:DB:AC
IPv4 Address : 10.7.225.99

eth0 Link encap:Ethernet HWaddr 00:D7:8F:F6:DB:AC
inet addr:10.7.225.99 Bcast:10.7.225.255 Mask:255.255.255.0
inet6 addr: fe80::2d7:8fff:fef6:dbac/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:136 errors:0 dropped:0 overruns:0 frame:0
TX packets:1634 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:9616 (9.3 Kb) TX bytes:88297 (86.2 Kb)

> show route
Kernel IP routing table
Destination        Gateway        Genmask        Flags     Metric     Ref         Use Iface
10.7.225.0         0.0.0.0        255.255.255.0     U             0             0            0 eth0
127.0.0.            0 0.0.0.0        255.255.0.0       U           0                0           0 cplane
0.0.0.0             10.7.225.1            0.0.0.0         UG          0                0          0 eth0

I am sure the cabling/design for Management is supported from the deployment guides I have looked at.

[singhkulbir29881]

On Firepower module change the default gateway to ASA management  interface IP and ensure that you are inspecting the icmp traffic. By default, ASA is not inspecting ICMP traffic.

Are to able to configure Firepower module using ASDM ?

[GRANT3779]

According to the guide

http://www.cisco.com/c/en/us/td/docs/security/asa/quick_start/sfr/firepower-qsg.html

I should be able to point to a L3 interface.

This is a setup I have with other ASAs, only difference being this is a 5506. Others have been ASAs with added SSD.

[Marvin Rhoads · Accepted solution]

Your setup indeed appears correct per the guides and what I have seen working in other deployments.

I'd check the switchport and make sure there's no restriction such as port security.

Are you getting arp cache entries at each end (i.e., on the switch for .99 and module for .1)?

[GRANT3779]

@Marvin,

I knew there was switch port security on the port (allowing 2 MACS) and did check the status yesterday which looked good... Anyways, I just removed Port Security, brought port down and up. Now all is good in the world!

Thanks for the nudge..

[Marvin Rhoads]

GRANT3779  ,

You're welcome. Thanks for the rating.

I got lucky on my first guess today. 🙂