Understanding Interface BVI on ASA

[williammanurung]

Hello Guys,

Can you explain what exactly purpose configure ip interface bvi on asa?

Thanks.

[Flavio Miranda]

Hello,

 BVI (Bridge Virtual Interface) is necessary to configure Bridge Groups in a transparent mode Firewall.

ciscoasa(config)# interface bvI 1
Specify the management IP address for the bridge group.

ciscoasa(config-if)# ip address x.x.x.x  255.255.255.0 standby x.x.x.y

 You can find a very good material here:

https://www.techtutsonline.com/interface-configuration-in-cisco-asa-transparent-mode/

[williammanurung]

Thanks your reply.

I have read the article, but im still confuse.
Each bridge group requires a management IP address. The ASA uses this IP address as the source address for packets originating from the bridge group. The management IP address must be on the same subnet as the connected network. For IPv4 traffic, the management IP address is required to pass any traffic.

I have a  lot of question about that statement.
1)Each bridge group requires a management IP address . For what management ?
2) Why asa use bridge virtual ip as the source for packet originating?

[Flavio Miranda]

If you ever worked with Firewall in context mode, you already saw that each context is somehow a separeted firewall. The same concept apply to bridge group.

 Management IP address suggest that this should be used for management only but it is largelly used for the main IP address. For example, in Wireless Lan Controller the Management IP address is in fact the IP address used for everything.

 Regarding you second question, it falls on the same idea. If you think about bridge group as a virtual firewall, Management IP is used to communicate with outside network. 

[williammanurung]

Management IP address suggest that this should be used for management only but it is largelly used for the main IP address. For example, in Wireless Lan Controller the Management IP address is in fact the IP address used for everything.

can the management ip bvi for ssh remote?

Regarding you second question, it falls on the same idea. If you think about bridge group as a virtual firewall, Management IP is used to communicate with outside network. 

What do you mean communicate with outside network? Can you give me explain?

[Karsten Iwen]

The transparent firewall was already mentioned, the second use case is to combine routed ports into one Vlan to function like a switch as it was done on the ASA 5505.