I have two sites linked by VPN with ASA 5525-X. In Site A we have management network (172.16.30.0/28) where we have management IP of ASA 5525-X IPS (172.16.30.14) and IPS (172.16.30.13). The IPS has a default gateway IP of the backbone (172.16.30.1). I have the Firepower Management Center in the management network with IP 172.16.30.10. Then the IPS is registered correctly to the FMC in Site A.
In the remote Site B i have the same architecture. The management IP of ASA is in the management network (172.16.8.0/26). The IPS module of ASA has an IP in the same management network. And default gateway for the IPS is the backbone switch.
My objective is to register the IPS module (which is in the management network in Site B) to the FMC in the management network in Site A. I add the two management networks in the crypto map. I added routing and ACL. I authorized ping between the two subnets but i noticed that the ASA always deletes the traffic with teardown of syn timeout.
I think my problem is linked to the fact that the management interface does not play by the same rules as other interfaces on the firewall. In fact it seems by default management interface does not pass or receive traffic from any other interface on the device due to the "Management-Only" setting. On each backbone i have a default route which routes all vlans to the inside interface of the respective ASA. I would like to route all traffic to the management network through the L3 switch on the Inside, but the ASA sees the Management network as directly connected via the Management interface.
I would like the traffic to take the following path:
FMC > L3 Switch > ASA Inside > VPN <---------> VPN > L3 Switch > IPS