Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Transparent mode ASA and management

I have just installed a new ASA5512 in transparent mode. This is the first time I have done this type of installation and have been having some issues getting remote management to the device. I have configured a BVI interface for management with an IP of 10.252.255.25.

The network looks like this......

172.19.130.5 --- LAN --- Router --- MPLS --- Router 10.252.255.30 ---- ASA Gi0/1 ---- ASAGi0/0 ----- Switch to LAN ---- 10.252.0.0 clients

So, from my management workstation on 172.19.130.5 I can ping the router at 10.252.255.30, I can also ping and manage the client machines on the 10.252.0.0 network on the other side of the ASA but I cant manage the ASA on 10.252.255.25. It going to be something I haven't done so any help would be greatly appreciated.

Please see config attached.

Murray

Everyone's tags (3)
13 REPLIES
Silver

Transparent mode ASA and management

Did you check the ASA logs when you try to connect to the BVI

Value our effort and rate the assistance!
Silver

Transparent mode ASA and management

Do you still need assistance?

Value our effort and rate the assistance!
New Member

Re: Transparent mode ASA and management

Hi jumora,

Yes I am still experiencing the issue. Because the device is now on a remote site I am not able to get to a management machine to console onto it. I can contact a person on site but they are not that experienced at working at the command line and they have other duties to attend to.

Did you manage to look at the config it posted to verify that it was OK?

Murray

Sent from Cisco Technical Support iPad App

VIP Green

Re: Transparent mode ASA and management

Are you unable to connect with both SSH and ASDM?

I noticed you do not have an SSH command for 172.19.130.5

ssh 172.19.130.5 255.255.255.255 inside

--

Please remember to rate and select a correct answer

Re: Transparent mode ASA and management

Configuration wise everything looks OK.

IP address asignment

Routing setup.

SSH setup (Marius 130.5 is included on that range)

So as long as the destination IP address is on the 172.19.128.0/22  you should be able to connect..

Are you able to ping the ASA?

do the following

cap capin interface inside match tcp host 172.19.130.5 host 10.252.255.25 eq 22

Then try to connect via SSH and share

show cap capin

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Transparent mode ASA and management

Hi Julio,

I will ask the local guy on site to use the capture commands and get the output and have a look.

Just to add that I can ping devices either side of the firewall so I know it spassing the traffic, so i think that its either a config issue or a problem with the traffic getting back to my management worksatation.

172.19.130.5 --- LAN --- Router --- MPLS --- Router 10.252.255.30 ---- ASA Gi0/1 ---- ASAGi0/0 ----- Switch to LAN 10.252.255.17 ---- 10.252.0.0 clients

Transparent mode ASA and management

Hello,

Okey let us know,

By te way from wich IP address are you comming?

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Transparent mode ASA and management

Im using 172.19.130.5 as the source IP

Transparent mode ASA and management

Hello,

Okey,

Are you 100 % sure 10.252.255.30 is the next-hop IP address.

By the way are you available for a tshoot session?

Let me know via a message (check ur inbox)

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Re: Transparent mode ASA and management

So I have managed to get the very helpful guy on site to capture some packets. When I try to SSH to the device no packets are captured, however, if I try to SSH to an IP on the other side of the FW I get packets being captured as shown below.

I have gone over the config but still can't find a problem, I'm close to pulling my hair out on this one.

TEE-FDC-FW01# cap capin int inside match tcp any any eq 22
TEE-FDC-FW01# sh cap capin

6 packets captured

1: 15:41:50.028852 10.64.68.32.20472 > 10.252.200.13.22: S 4240694991:4240694991(0) win 8192
2: 15:41:50.030317 10.252.200.13.22 > 10.64.68.32.20472: R 0:0(0) ack 4240694992 win 0
3: 15:41:50.563447 10.64.68.32.20472 > 10.252.200.13.22: S 1154043407:1154043407(0) win 8192
4: 15:41:50.564820 10.252.200.13.22 > 10.64.68.32.20472: R 0:0(0) ack 1154043408 win 0
5: 15:41:51.094508 10.64.68.32.20472 > 10.252.200.13.22: S 386805799:386805799(0) win 8192
6: 15:41:51.095667 10.252.200.13.22 > 10.64.68.32.20472: R 0:0(0) ack 386805800 win 0
6 packets shown

Sent from Cisco Technical Support iPad App

Re: Transparent mode ASA and management

Hello Murray,

Are you sure the packets should arrive on the Inside interface????

If the answer is yes Then the problem is not on the ASA as the traffic is not even reaching the ASA, I would recommend then doing a SPAN monitor session on the L2 network to see where the packets are going

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
New Member

Re: Transparent mode ASA and management

Hello again,

Its been a while.

Here is the output from he capture.

As can be seen, I can traverse the firewall and SSH to a device on the otherside but not to the firewall itself.

TEE-FDC-FW01# cap capin int inside match tcp any any eq 22

TEE-FDC-FW01# sh cap capin

6 packets captured

   1: 15:41:50.028852 10.64.68.32.20472 > 10.252.200.13.22: S 4240694991:4240694991(0) win 8192

   2: 15:41:50.030317 10.252.200.13.22 > 10.64.68.32.20472: R 0:0(0) ack 4240694992 win 0

   3: 15:41:50.563447 10.64.68.32.20472 > 10.252.200.13.22: S 1154043407:1154043407(0) win 8192

   4: 15:41:50.564820 10.252.200.13.22 > 10.64.68.32.20472: R 0:0(0) ack 1154043408 win 0

   5: 15:41:51.094508 10.64.68.32.20472 > 10.252.200.13.22: S 386805799:386805799(0) win 8192

   6: 15:41:51.095667 10.252.200.13.22 > 10.64.68.32.20472: R 0:0(0) ack 386805800 win 0

6 packets shown

VIP Green

Transparent mode ASA and management

My bad, missread the subnetmask

--

Please remember to rate and select a correct answer
524
Views
0
Helpful
13
Replies
CreatePlease to create content