cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5846
Views
0
Helpful
16
Replies

Management access (ASDM/console) to FWSM through the outside interface (Sec level 0)

Siju S
Level 1
Level 1

What am I not able to have admin access (ASDM/console) on FWSM through the outside interface (Sec level 0)

16 Replies 16

Anu M Chacko
Cisco Employee
Cisco Employee

Hi,

Is the FWSM in multiple context? Have you allowed your network to have asdm access to the outside? Could you post the "sh run" here?

Regards,

Anu

Its not in multi-context

Access has been enabled , but still iam not able to connect from outside interface or routed vlan's, however iam able to access from all inside interfaces (higher sec level)

http server enable

http 10.0.X.0 255.255.255.0 outside

management-access outside

asdm location 10.0.x.x 255.255.255.255 outside

Hi Kauser,

The IP you're using is a Private IP. i would expect to see a public IP subnet in those commands, since you're trying to connect to the outside interface from an outside network.

Hope this helps!

Regards,

Anu

The outside and inside interfaces  are virtual interfces separating priviate vlans in a core switch hosting  servers.

.Basically iam not able to get admin access from  security level 0 interface .I need to find out whether there is any way  to achieve this

varrao
Level 10
Level 10

Hi Kausar,

Can you provide the configuration that you ahve done for admin access on outside along with the running-config.

Varun

Thanks,
Varun Rao

Hi Kauser,

The location from you are testing needs to be connected to the outside interface, I am not sure, but it seems that you are trying to connect from a PC which is on the inside interface,  you would not be able to access the ASDM from a remote interface. You can ASDM into the firewall from internet, for which the request would fall on the outside interface, in your case i guess the request is coming on the inside interface, for ASDM on outside, which is not correct.

Thanks,

Varun

Thanks,
Varun Rao

The outside and inside interfaces are virtual interfces separating priviate vlans in a core switch hosting servers.

.Basically iam not able to get admin access from security level 0 interface .I need to find out whether there is any way to achieve this

Hi Kauser,

Could you post the output of "show run int" from the FWSM here? Also, is the FWSM running in multiple context?

Regards,

Anu

Firewall/6# sh run int

!

interface Vlan5

nameif DMZ5

security-level 50

ip address 10.X.X.X 255.255.255.0

!

interface Vlan6

nameif DMZ6

security-level 50

ip address 10.X.X.X 255.255.255.0

!

interface Vlan7

nameif DMZ7

security-level 50

ip address 10.X.X.X 255.255.255.0

!

.

.

.

.

interface Vlan100

nameif outside

security-level 0

ip address 10.X.X.X 255.255.255.252

!

interface Vlan101

description LAN Failover Interface

!.

interface Vlan102

nameif inside

security-level 100

ip address 10.X.X.X 255.255.255.0

Hi Kauser,

Is NAT enabled on the firewall? How does the world see the outside IP? What is the next hop for this firewall(def route)? It would be great if you can post the output of "sh run" here.

Regards,

Anu

Dear,

This is an FWSm module with default route to Core Sw MSFC , the outside IP can be reached from any access vlan in core sw

Hi Kauser,

What is the IP address of the host from where you're trying to reach the FWSM outside interface? Give me an eg.

Regards,

Anu

Siju S
Level 1
Level 1

Anybody experiencing the same difficult , is there any workaround ?

Hello Kausar,

First of all lets take out all the ASDM configuration ( just in case the ASDM daemon got stuck)

no  http server enable

no http 10.0.X.0 255.255.255.0 outside

Now can you add the following command just to test the connection?

http server enable

http 0 0 outside

If this do not work,I would like to see the debug for the http protocol

Debug http

Please provide the output of the debug.

Regards,

Please rate helpful posts!!

Julio

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: