Firepower - accessing FDM management through RA VPN

[janslu]

I want to use VPN RA to access management interface with FDM on Firepower using 7.2.0.1 software. I have set up anyconnect RA and I can successfully access internal servers already, but I can't access the FDM interface... I found earlier discussions and a bug report (now marked as resolved). Is this still an issue or is this just a missing configuration?

As for details:
I am using 192.168.0.x subclass inside. VPN pool is using 10.0.0.x subclass. Management interface is connected by a cable to one of the switch interfaces and is using a dedicated 192.168.0.150 IP. I can connect to it from computers on the same network without an issue, but anyconnect clients can't.

Do I need an ACL to allow access? If so - how should I construct the rule? 

[Rob Ingram]

@janslu use flexconfig to configure "management-access <inside interface>"

[janslu]

@Rob Ingram I just tried:

added a FlexConfig Object with 'management-access inside' and 'no management-access inside' commands. Saved it and deployed - no change. I can access the FDM on external interface (of course using a specific port to distinguish from VPN access) and after I connect Anyconnect VPN client I can't connect to the management interface (192.168.0.150 and the same specific port). There's just no response... 

[MHM Cisco World]

depend on are you config split tunnel ?

[janslu]

Here's the summary of my VPN config:

 Thanks for looking at this. I am moving from ASA to Firepower and it's much harder than I anticipated... 

[MHM Cisco World]

so you run split not tunnel all and you config INSIDE only in Split tunnel ?
I think you need to add the management subnet to Split ACL. 
also be sure to also include management subnet in NAT exception.

[janslu]

@MHM Cisco World My management is on inside. I am using 192.168.0.0/24 as an inside network. Management IP is 192.168.0.150 and management/1 port is connected by a cable to one of the switch ports inside. And it works well for computers connected to the inside (any of the 192.168.0.X subnet connected to the switch). VPN Pool is configured to use 10.0.0.0/24 subnet and after the connection is established it connects to the inside computers well, but not to the Cisco interface itself. So I can easily connect to an inside server on 192.168.0.10 but I can't get through to the 192.168.0.150 which SHOULD be a management port connected to the same switch. 

I tried adding the 192.168.0.150 Host to split (even though it should be covered by the subnet anyway) and also tried adding it to ACLs and permit 10.0.0.0/24 subnet to access 192.168.0.150 but it didn't help...

[janslu]

For future reference. This is a confirmed bug. Seems to be fixed in yet unreleased upcoming version. https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt73926