We have a Active/Standby HA ASA with 2 Firepower 2130 in appliance mode.
We use the Management interface as management-only and several interfaces.
We have a default route on the management interface and a default route on an external interface.
Which interface is used by the ASA to connect to the Cisco licensing services?
Thanks for the help
The ASA uses Cisco Smart Software Licensing. here is the Guide how to implement it
On 2100 the ASA communicates with the Cisco Smart Licensing portal (cloud) using the ASA interfaces, not the FXOS management.
n this case, HTTP local authentication is used on outside interface:
ciscoasa(config)# show run http
http server enable
http 0.0.0.0 0.0.0.0 outside
ciscoasa(config)# show run aaa
aaa authentication http console LOCAL
ciscoasa(config)# show run username
username cisco password ***** pbkdf2
You can only connect to the ASA via ASDM if there is a 3DES/AES license enabled. For an ASA that is not already registered this is possible only on an interface that is management-only. Per configuration guide: "Strong Encryption (3DES/AES) is available for management connections before you connect to the License Authority or Satellite server so you can launch ASDM. Note that ASDM access is only available on management-only interfaces with the default encryption. Through the box traffic is not allowed until you connect and obtain the Strong Encryption license". In different case you get:
ciscoasa(config)# debug ssl 255
debug ssl enabled at level 255.
error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher
To overcome the ASA has management-only configured on the Internet-facing interface and thus ASDM connection is possible:
ip address 192.168.123.111 255.255.255.0 standby 192.168.123.112