cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
588
Views
0
Helpful
4
Replies

What is best practice for the http server on ASAs

Fartingdragon
Level 1
Level 1

Right now it's set for this. Is there a better way? 

http DMZ 255.255.255.0 management
http 0.0.0.0 0.0.0.0 inside

4 Replies 4

Marvin Rhoads
Hall of Fame
Hall of Fame

The command controls where you want to allow management traffic to originate from. If you need it from any inside subnet then the second line does that. The first line in your config would not normally be a best practice as a DMZ should have restrictive security policies to limit exposure of and access to/from servers in that network.

To remove it. Is it just

No http dmz 255.255.255.0?

http DMZ 255.255.255.0 management
http 0.0.0.0 0.0.0.0 inside

You use dmz as source ip to access mgmt interface not using dmz interface.

I always prefer two http line 

In such a case that interface is down or unreachable for any reason I have other one I can use.

Config any asa interface for http except outside interface.

That my opinion.

Review Cisco Networking for a $25 gift card