I have got a new ASA 5512 appliance for VPN. Is the managament interface on this applaicne is out of band? Thta is: can I use this interface exclusively for administration of the appliance?
As Marvin has mention earlier, you would configure a static route pointing out the managment interface. the default gateway would not point out the management interface as this is used to gain access to networks that are unknown...aka internet.
route managment 10.1.1.0 255.255.255.0 192.168.1.1
You would also need to define what addresses are allowed to manage the ASA device as well as what protocol they can use to manage the device. (if you haven't enabled the management protocols on the ASA, you will have to do that also)
ssh 10.1.1.0 255.255.255.0 inside
http 10.1.1.0 255.255.255.0 inside
It's similar to that yes - you do it with a (static) route statement associated with the nameif (usually Management = default) you've assigned under the interface Management 0/0 sections of the configuration.
Say your inside network is all in the 10.0.0.0/8 range. In that case, you would enter:
route Management 10.0.0.0 255.0.0.0
Issues can arise if you aren't running a dynamic routing protocol on the ASA's inside interface (whcich probably more than half of the customers I've seen doing since the ASA is not nearly as capable at routing as a "real" router) and you already have a similar route statement on the Inside interface.
When that's the case, many engineers just throw up their hands and manage the ASA via the inside interface. Depending on your routing setup, there are usually work arounds that can be put in place with a bit of thought and planning.
You can manage an ASA 5512 via any interface (assuming the rules are setup to allow it). It also has a serial console port for direct hardware access.
The best practice is to use the Management 0/0 Ethernet interface designed for that purpose but it's not required. By default the M0/0 port is used.
The appliance should have come with a quick start guide but here a link to it: