1

I want to add a redundant interface to my Cisco ASA 5510. The management interface is currently using Ethernet0/1 (10.1.25.254/24) one of the interface I want to use for the redundant interfaces. So I wanted to setup Management0/0 as the new management interface. The other interface I want to use is Ethernet0/2 (10.1.0.254/24) for the redundant interface. The Ethernet0/3 (10.1.251.5/24) interface is not going to be part of the redundant interface.

I gave the Management0/0 an IP address of 10.1.254.5, and was able to connect a win7 box to Management0/0 and use 10.1.254.5 as a gateway; and ping another address on the (10.1.251.0/24) network, but I can't ping the interface (10.1.254.5) itself. I also can't use ASDM/SSH to log onto the ASA at 10.1.254.5.

I setup rules in Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH. That look like the original rules for the Ethernet0/1 interface.

The last thing I can think to try would be to change the Configuration > Device Management >Management Access > Management Interface. I'm a bit nervous about changing it, the description of it is a bit vague. What it's going to do if I change it? What is the correct way to change a management interface?

7
  • Can you provide more information about how it's configured? Is the interface on the same network as the e0/1 interface? And what do you mean when you say that you can "ping another address on the network" - is this when connected only to the ASA's management port? Dec 30, 2011 at 21:29
  • @Shane what else do I need to add to my question? Jan 3, 2012 at 14:19
  • Are you absolutely sure that you weren't connected to wireless or something when plugged into the management port? A management port shouldn't route traffic; you should not have been able to ping the 10.1.251.0/24 network from the other side of the management interface. Jan 3, 2012 at 16:25
  • I disable the wireless card while I did that. I should also note I'm a bit of newbie with I comes to networking. Jan 3, 2012 at 17:10
  • @Shane Could it be that both those interfaces have the same security level of 100? Jan 3, 2012 at 17:50

2 Answers 2

3

I believe "management-access" means just what it says. This interface will be dedicated for just management and data will not be allowed to flow (pass) through the interface itself and you can only have one.

Could you post everything below and scrub any of the config that you don't want the public to see?

show run icmp

show run ssh

show run http

show run int management 0/0
3
  • You're answering a question that is over a year old, and the information that you're attempting to convey was already present within the comments of the question itself. Remember to expand them!
    – Andrew B
    Mar 16, 2013 at 18:12
  • 1
    My apologies. I clicked on the Server Fault site and it showed question as active so I answered. I will keep that in mind going forward. Thanks! Mar 17, 2013 at 18:04
  • No problem. And belatedly, welcome to Serverfault. :)
    – Andrew B
    Mar 17, 2013 at 19:35
2

I got it working, but not sure if it's the correct way. I connect a computer to the serial port, and ran these commands.

ASA(config)# show run management-access
management-access Inside
ASA(config)# management-access mgmt
Please remove the management access before configure a new one
ASA(config)# no management-access Inside
ASA(config)# management-access mgmt

Now I can ssh into 10.1.254.5 and ping it. I can also still use the old ip address too 10.1.25.254. Which is odd because, I was thinking 10.1.25.254 would stop working when I ran that command. So what is "management-access" command doing? should I ask a separate question for that?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .