Just configure it like any other interface. The only tricky bit is routing. Historically the ASA had only a single global routing table so traffic from the management interface trying to get back to some internal subnet didn't easily have a return path (since traffic cannot flow from the management interface through the ASA). So unless you were running a true out of band management network, routing was challenging. Since ASA 9.5(1) we have the option of setting up a separate management routing table. https://www.cisco.com/c/en/us/td/docs/security/asa/asa95/configuration/general/asa-95-general-config/route-overview.html#concept_40C0C8DE2C1247319250B9F7706C54A5 ... View more

You'd have to first return (deregister) the current license: https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/general/asa-98-general-config/intro-license-smart.html#task_f54_txr_y1b You would then need to have deployed a local Cisco Smart Software Manager (CSSM) and run it in offline mode. It requires periodic copy/paste of your authorization from cisco.com into the server. If you have the option of running the CSSM server online you can also use Permanent License Reservation or Specific License Reservation. See pages 128-129 here for an illustration: https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2019/pdf/BRKARC-2034.pdf Either way, you should open a case with Cisco licensing as you'd have to get the smart account authorized for these features. Contact TAC or email licensing@cisco.com to get started. ... View more

You didn't answer how the server is actually configured - if it's using the private address then we would not expect clients to try to connect using the NATted address of 81.144.xxx.xxx. You might try telling the ASA to translate DNS replies (i.e. use the "dns" parameter in your relevant NAT rule) https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/I-R/cmdref2/n.html#pgfId-1778544 ... View more

A Firepower Management Center support entitlement will include the right to download and use the User Agent software. ... View more

Your ASA 5520 is not vulnerable to this bug. As noted in the Security Advisory, " This vulnerability applies only to the ASA hardware platforms that use a specific  cryptographic  driver for SSL and TLS packet decryption and encryption. " The vulnerable products (ASA 5506, 5508 and 5516 series) all have a common cryptographic driver due to their use of a chipset (Cavium Octeon III 7130) unique to that hardware. Ironically that chipset is intended to make the hardware platforms MORE secure. That is coincidentally why they all use the unique images with the "lfbff" string in the image name indicating digitally signed and verified images. ... View more

As your log notes: no matching kex found: client ssh-rsa server ssh-dss Try updating your client software (putty etc.) to a newer version. Newer IOS versions have deprecated the older ssh-rsa key exchange. ... View more

Sorry but, given this single ASA that you have, there is no avenue for obtaining these software image or IPS signatures. One can opine whether or not this should be the case, but it's how it is (and how it has been for many years). ... View more

Sorry but we cannot provide software or links to unauthorized sources. ... View more

You're welcome. Yes, that's correct - only prefilter it with Fastpath action. Since the traffic is IPsec encapsulated and coming from known endpoints, none of the NGIPS processes (Snort, SI, Malware detection etc.) can add any value so prefilter will just Fastpath the DMVPN traffic to the post-processing stages (ALG, egress interface selection etc.). FTD Order of Operations   ... View more

Only data path interfaces should be setup with standby addresses. Your ASA management1/1 addresses should not be included in the failover setup. Each management interface should have a unique IP address (and MAC address when using locally administered addresses such as you are using). When a unit changes role, the management interface address will remain the same.  ... View more