Cisco – Manage Cisco ASA Firepower ASDM

ciscocisco-asa

Cisco recently made available Firepower management via ASDM along with Firesight VM. I am using ASDM to manage and I am unable to see "Create new policy" under Configuration->Asa Firepower configuration->Access policy. The only policy I see is default policy and there is no button to enable it.

Have control and malware license applied. I tried rebooting firepower module.

Anyone had the same issue?

I am running Asa 5515x version 9.5(1)5, Firepower 6 and ASDM 7.5(2). The latest Java as well.

One thing that may not be relevant: ASDM can't connect to Firepower module when I am connecting via public ip address from outside. I need to connect from inside or connect to vpn and then use inside ip.

Thanks

Best Answer

I have the same configuration and software release. On your screenshot, the Acces control policy has an out of date status. This means you need to deploy ASA FirePower change with ASDM Deploy button.

It will create a task to apply the newest firepower configuration, then wait a few minutes for that task to complete. When Acces Control Policy shows "up to date on device" your access control policy should work correctly.

Related Solutions

Cisco ASA – Remote Users Cannot Access Site-to-Site Tunnel

Got a response on the cisco forums that solved my problem.

you are missing NAT exempt from the IP local pool to the destination of the site to site:

access-list NAT_EXEMPT permit ip 10.0.0.0 255.255.255.0 172.17.0.0 255.255.0.0

NAT (outside) 0 access-list NAT_EXEMPT

Cisco ASA – Configuring Spoke-to-Spoke with NAT 9.1

This is a really old post, and that's a complex set of requirements. But I'll try to answer this question for anyone else who may be looking to do a similar thing.

First, a diagram:

Now, some notes:

I did not actually test this in a lab, but it should work in real life.
I chose not to do the VPN1<->VPN2 NAT on the HQ, although you can using nat (outside,ouside) .... In order to keep the HQ config more simple, I have the spokes do their own NAT towards each other.
Because of the PAT on VPN2, no traffic will be able to enter VPN2 unless it originated from there. I assume that's what you wanted. If not, just create a twice NAT (a.k.a., A manual NAT) higher up in the order to do something different, instead.

Now, the code:

!! VPN1
access-list crypto_vpn1_acl permit ip 10.5.0.0 255.255.255.0 10.4.0.0 255.255.255.0
access-list crypto_vpn1_acl permit ip 192.168.200.0 255.255.255.0 192.168.1.0 255.255.255.0
object network obj_192.168.1.0_24
 subnet 192.168.1.0 255.255.255.0
object network obj_192.168.200.0_24
 subnet 192.168.200.0 255.255.255.0
object network obj_10.4.0.0_24
 subnet 10.4.0.0 255.255.255.0
object network obj_10.5.0.0_24
 subnet 10.5.0.0 255.255.255.0
nat (inside,outside) source static obj_10.5.0.0_24 obj_10.5.0.0_24 dest static obj_10.4.0.0_24 obj_10.4.0.0_24
nat (inside,outside) source static obj_10.5.0.0_24 obj_192.168.200.0 dest static obj_192.168.1.0_24 obj_192.168.1.0_24
route outside 10.4.0.0 255.255.255.0 x.x.x.x
route outside 192.168.1.0 255.255.255.0 x.x.x.x

!! HQ
same-security-traffic permit intra-interface
access-list crypto_vpn1_acl permit ip 10.4.0.0 255.255.255.0 10.5.0.0 255.255.255.0
access-list crypto_vpn1_acl permit ip 192.168.1.0 255.255.255.0 192.168.200.0 255.255.255.0
access-list crypto_vpn2_acl permit ip 10.4.0.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list crypto_vpn2_acl permit ip 192.168.200.0 255.255.255.0 192.168.1.0 255.255.255.0
object network obj_10.4.0.0_24
 subnet 10.4.0.0 255.255.255.0
object network obj_10.5.0.0_24
 subnet 10.5.0.0 255.255.255.0
object network obj_192.168.1.0_24
 subnet 192.168.1.0 255.255.255.0
nat (inside,outside) source static obj_10.4.0.0_24 obj_10.4.0.0_24 dest static obj_10.5.0.0_24 obj_10.5.0.0_24
nat (inside,outside) source static obj_10.4.0.0_24 obj_10.4.0.0_24 dest static obj_192.168.1.0_24 obj_192.168.1.0_24
route outside 10.5.0.0 255.255.255.0 x.x.x.x
route outside 192.168.1.0 255.255.255.0 x.x.x.x

!! VPN2
access-list crypto_vpn2_acl permit ip 192.168.1.0 255.255.255.0 10.4.0.0 255.255.255.0
access-list crypto_vpn2_acl permit ip 192.168.1.0 255.255.255.0 192.168.200.0 255.255.255.0
object network obj_10.5.0.0_24
 subnet 10.5.0.0 255.255.255.0
object network obj_pat_address
 host 192.168.1.1
object network obj_10.4.0.0_24
 subnet 10.4.0.0 255.255.255.0
object network obj_192.168.200.0_24
 subnet 192.168.200.0 255.255.255.0
nat (inside,outside) source static obj_10.5.0.0_24 obj_pat_address dest static obj_10.4.0.0_24 obj_10.4.0.0_24
nat (inside,outside) source dynamic obj_10.5.0.0_24 obj_pat_address dest static obj_192.168.200.0_24 obj_192.168.200.0_24
route outside 10.4.0.0 255.255.255.0 x.x.x.x
route outside 192.168.200.0 255.255.255.0 x.x.x.x

Hope this helps somebody.

Best Answer

Related Solutions

Cisco ASA – Remote Users Cannot Access Site-to-Site Tunnel

Cisco ASA – Configuring Spoke-to-Spoke with NAT 9.1

Related Topic