IPS Registering to FMC over VPN

Question

help please.

I have two sites linked by VPN with ASA 5525-X. In Site A we have management network (172.16.30.0/28) where we have management IP of ASA 5525-X IPS (172.16.30.14) and IPS (172.16.30.13). The IPS has a default gateway IP of the backbone (172.16.30.1). I have the Firepower Management Center in the management network with IP 172.16.30.10. Then the IPS is registered correctly to the FMC in Site A.

In the remote Site B i have the same architecture. The management IP of ASA is in the management network (172.16.8.0/26). The IPS module of ASA has an IP in the same management network. And default gateway for the IPS is the backbone switch.

My objective is to register the IPS module (which is in the management network in Site B) to the FMC in the management network in Site A. I add the two management networks in the crypto map. I added routing and ACL. I authorized ping between the two subnets but i noticed that the ASA always deletes the traffic with teardown of syn timeout.

I think my problem is linked to the fact that the management interface does not play by the same rules as other interfaces on the firewall. In fact it seems by default management interface does not pass or receive traffic from any other interface on the device due to the "Management-Only" setting. On each backbone i have a default route which routes all vlans to the inside interface of the respective ASA. I would like to route all traffic to the management network through the L3 switch on the Inside, but the ASA sees the Management network as directly connected via the Management interface.

I would like the traffic to take the following path:

FMC > L3 Switch > ASA Inside > VPN <---------> VPN > L3 Switch > IPS

Answer 1

Your suspicion is correct that the ASA is giving you troubles because the management network is directly attached. Let's describe the problem in more detail, so other people can see it:

1. The Firepower sensor is a software module in an ASA that is configured separately from the ASA. It has its own software (kinda like a Virtual Machine in the ASA), and its own config, which includes an IP address and a default gateway.
2. The Firepower sensor uses the ASA's Management0/0 port. It's like there's a virtual switch in there because the ASA gets to use the port, too.
3. When the Site B IPS wants to talk to the Site A FMC, it sends packets to the default gateway at Site B, which is the core switch. The core switch routes it to the inside interface of the ASA.
4. The ASA sees this as a problem because there is traffic arriving on the inside that is supposed to be directly attached to the M0/0 port. I think under normal circumstances, this would be dropped by anti-spoofing rules.

The best solution here is to establish management to both ASAs using a different interface than their management ports. So, add some ssh, http, logging, (maybe also aaa) commands to make everything work using the inside interfaces. Then remove the IP addresses from the M0/0 ports, but don't shut the ports down (the Firepowers uses them!). Keep the core switches the way they are, with the vlan interfaces. Lastly, add routes to each ASA to point its local management subnet at its local core switch.

In this scenario, traffic will route correctly from the sensors, to the cores, to the firewalls, through the VPN.

If you choose to keep the management interfaces, you could solve this problem by removing the vlan interfaces from your core switches (but keep the vlans). You would use the ASA's M0/0 ports as the default gateways for the sensors and the FMC. But, this design don't meet the requirement you set forth.

I can't currently dream up a way to get the Site B sensor to register to the Site A FMC by using the Layer3 core switches without removing the management addresses on the ASAs. Perhaps there's something I'm not thinking of.