Cisco WLC 5508 WebGui and SSH not available in routed network

[markus.bock]

Hello,

we have moved internal vlan routing from core switch to cisco asa. 

Since the routing is moved I cannot access the web gui and ssh of our wireless controller 5508 over the management interface which is placed in another vlan where my client is.

I can ping it and in the internal firewall (ASA5545X) in the log a SSL or SSH session has been created successfully. But in my webbrowser is shown that the webinterface is not reachable.

When I put my client in the management VLAN where the wlan controller is pleaced in, I can access the controller via web or ssh.

Does anybody know a solution for this?

[marce1000]

 - Well clearly you need to review the ASA policy so that the client can get access to the management VLAN and or the controller-only if you want to narrow things down. All routing tables should be correct too.

 M.

[Jaderson Pessoa]

Well,

If just trough ASA it doesnt work.. certainly it is a policy that need be reviewed.

[markus.bock]

I have tried it with an ANY rule but it still does not work.

In the management vlan i have several switches and the access is working via https and ssh.

Routing should be ok because I got response via icmp and the gateway is correctly configured on the wlc.

I have configured the service ports on the wlc cluster and I can access the service ports, which are configured in other vlans too, without problem. But I need webGUI access on the management interface

[Jaderson Pessoa]

please, share here the configuration of wlc.

[markus.bock]

Here is the config

Thanks and kind regards

[Jaderson Pessoa]

config interface address management 192.168.0.120 255.255.0.0 192.168.0.1 this is the management network used to access your controller.

if you is connected directly to this network, works.. right? but when you want access it trough an other network using your ASA, it doesn't work, right?

share asa configuration here... please.

[markus.bock]

Yes, 192.168.0.120 is the management IP Address

It could not be a problem or config missmatch on the asa because all Switches in 192.168.0.0 network using the same gateway and access via https and ssh is working. 

The problem must be by the controller because I have enabled telnet and it does not work too.

[Jaderson Pessoa]

well.. i cant see any problem in your wlc configuration.. if you can post asa configuration.. certainly it will help us.

from controller, please... ping it own gateway 192.168.0.1 and trace route to a device from where you are trying accesst web gui.

[markus.bock]

In the screenshot attached you can see from asa log the successful https connection to the controller

Ping and traceroute are shown correctly. Same like a traceroute to a switch

[markus.bock]

I can ping the gateway from controller cli. 

But when I do a ping to another network, the controller uses his service ports ip address

[Scott Fella]

The service port should not be connected to the network. If it is connected to the network, then there should be no routing between the service port and the management interface of the controller. It does seem like the issue is with the asa as that was the only change.

[Jaderson Pessoa]

you need put your service port in other network "non routeable" or different network from your corporate network. as our friend said @Scott Fella

[patoberli]

If all of this doesn't help, you don't do any NAT on the ASA, right?

[markus.bock]

As far as I know it is not possible to put the service port into the same network as the management port.

My service port is in a different network and I do no NAT between the networks