Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

ASA 5512 Management

I have got a new ASA 5512 appliance for VPN. Is the managament interface on this applaicne is out of band? Thta is: can I use this interface exclusively for administration of the appliance?

3 ACCEPTED SOLUTIONS

Accepted Solutions
Hall of Fame Super Silver

ASA 5512 Management

You can manage an ASA 5512 via any interface (assuming the rules are setup to allow it). It also has a serial console port for direct hardware access.

The best practice is to use the Management 0/0 Ethernet interface designed for that purpose but it's not required. By default the M0/0 port is used.

The appliance should have come with a quick start guide but here a link to it:

http://www.cisco.com/en/US/docs/security/asa/quick_start/5500X/5500x_quick_start.html

Hall of Fame Super Silver

Re: ASA 5512 Management

It's similar to that yes - you do it with a (static) route statement associated with the nameif (usually Management = default) you've assigned under the interface Management 0/0 sections of the configuration.

Say your inside network is all in the 10.0.0.0/8 range. In that case, you would enter:

     route Management 10.0.0.0 255.0.0.0

Issues can arise if you aren't running a dynamic routing protocol on the ASA's inside interface (whcich probably more than half of the customers I've seen doing since the ASA is not nearly as capable at routing as a "real" router) and you already have a similar route statement on the Inside interface.

When that's the case, many engineers just throw up their hands and manage the ASA via the inside interface. Depending on your routing setup, there are usually work arounds that can be put in place with a bit of thought and planning.

ASA 5512 Management

As Marvin has mention earlier, you would configure a static route pointing out the managment interface.  the default gateway would not point out the management interface as this is used to gain access to networks that are unknown...aka internet.

route managment 10.1.1.0 255.255.255.0 192.168.1.1

You would also need to define what addresses are allowed to manage the ASA device as well as what protocol they can use to manage the device. (if you haven't enabled the management protocols on the ASA, you will have to do that also)

ssh 10.1.1.0 255.255.255.0 inside

http 10.1.1.0 255.255.255.0 inside

--

Please remember to rate and select a correct answer
9 REPLIES
Hall of Fame Super Silver

ASA 5512 Management

You can manage an ASA 5512 via any interface (assuming the rules are setup to allow it). It also has a serial console port for direct hardware access.

The best practice is to use the Management 0/0 Ethernet interface designed for that purpose but it's not required. By default the M0/0 port is used.

The appliance should have come with a quick start guide but here a link to it:

http://www.cisco.com/en/US/docs/security/asa/quick_start/5500X/5500x_quick_start.html

ASA 5512 Management

The management port on the ASAs are completely out of band.  Even if you put the ASA into multiple context, where the configuration of the ASA will be removed and placed in a file config.old, the managment interface will remain and you will still have access to the ASA through this port.  Just keep in mind that the managment port is not a Gig port and only supports 10/100 speed.

--

Please remember to rate and select a correct answer
Community Member

Re: ASA 5512 Management

So where do I define the default gateway? Do I need a separate gateway for the management alone like ILOM in Solaris?

Hall of Fame Super Silver

Re: ASA 5512 Management

It's similar to that yes - you do it with a (static) route statement associated with the nameif (usually Management = default) you've assigned under the interface Management 0/0 sections of the configuration.

Say your inside network is all in the 10.0.0.0/8 range. In that case, you would enter:

     route Management 10.0.0.0 255.0.0.0

Issues can arise if you aren't running a dynamic routing protocol on the ASA's inside interface (whcich probably more than half of the customers I've seen doing since the ASA is not nearly as capable at routing as a "real" router) and you already have a similar route statement on the Inside interface.

When that's the case, many engineers just throw up their hands and manage the ASA via the inside interface. Depending on your routing setup, there are usually work arounds that can be put in place with a bit of thought and planning.

Community Member

Re: ASA 5512 Management

Please clarify. Can I add default gateway at two places, one for management side (like ILOM) and one for ASA (firewall traffic like system NIC tcp/ip default gateway)?

Hall of Fame Super Silver

ASA 5512 Management

You don't typically put a default gateway on the management port but rather a static network route.

How you build that plus the routes out the inside vary according to your network environment and can't be answered in the specific without more detailed information about your network design.

ASA 5512 Management

As Marvin has mention earlier, you would configure a static route pointing out the managment interface.  the default gateway would not point out the management interface as this is used to gain access to networks that are unknown...aka internet.

route managment 10.1.1.0 255.255.255.0 192.168.1.1

You would also need to define what addresses are allowed to manage the ASA device as well as what protocol they can use to manage the device. (if you haven't enabled the management protocols on the ASA, you will have to do that also)

ssh 10.1.1.0 255.255.255.0 inside

http 10.1.1.0 255.255.255.0 inside

--

Please remember to rate and select a correct answer
Community Member

ASA 5512 Management

Understood, in that case I can not call the management interface out of band. Am I right?

Re: ASA 5512 Management

The managment interface is out of band and unless you specify otherwise it can not be used for anything other than management traffic.

--

Please remember to rate and select a correct answer
382
Views
0
Helpful
9
Replies
CreatePlease to create content