Accessing Cisco 9200 via SSH using Firepower 1010 in ASA mode

[OGWAN]

I have a CISCO 9200 configured with IP 192.168.1.2 on Gi1/0/48 VLAN101 and a default-gateway configured as 192.168.1.1. On my ASA I have an outside interface 10.10.10.2/29 and an inside interface configured as 192.168.1.1. I can access the switch internally, but I cannot access the switch via SSH via the Firepower 1010 configure in ASA mode. I have tried multiple ACLs, and NATs to no avail. I do not know what I am missing. Please advise. Thank you

[MHM Cisco World]

IOS XE sometimes not use known port of ssh 22' 

So if you use ACP with port 22 then that maybe drop ssh

Try use ACP without specify port 

also you can capture traffic in FW interface see the port use by SW is it 22 or other port 

MHM

[johnlloyd_13]

hi,

you'll need to configure inter-VLAN routing, identity NAT and ACL to permit SSH in your ASA. see link below.

just think of the DMZ in the example as your "outside" zone with lower security level.

https://ccnpsecuritywannabe.blogspot.com/2018/06/configuring-inter-vlan-routing-on-cisco.html

[OGWAN]

Thank you for the feedback. I tried your suggestions but I cannot still see the CISCO switch outside the ASA. Maybe I am missing a setting in the ASA? I have my Exchange and Web Servers working flawlessly but not the switch. Please advise.

[balaji.bandi]

Ok you trying from outside to inside traffic flow.

do you have NAT in place for that outside IP ? or is this NAT excepted.

Does to 10.10.10.X network know how to reach 192.168.1.X network.

Open a Live Logs and try connecting to device and see is the IP able to pass through the firewall ?

you can also put continuous ping to switch see the Live logs on ASA to confirm is this passing traffic.

You can also look switch logs is there any request coming in, show logging or you can enable debug.

[Richard Burts]

I am not clear about the topology that you are using. You tell us "I cannot access the switch via SSH via the Firepower 1010 configure in ASA mode". So are you initiating SSH from a device outside and expect the ASA to forward that request to the switch? In that case we need more information about the nat configured on the ASA.

In particular we need to understand how much you are using dynamic nat and whether you are also using static nat. 

If a device inside attempts access to a resource outside, dynamic nat will create an entry that allows the response to be translated and forwarded to the inside device. But for a device outside to access a device inside it requires a static nat for the inside device.