Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 408 / 2164

1-4
Cisco ASA Series CLI Configuration Guide
Chapter 1 Starting Interface Configuration (ASA 5510 and Higher)
Information About Starting ASA 5510 and Higher Interface Configuration
Management Interface for Transparent Mode
In transparent firewall mode, in addition to the maximum allowed through-traffic interfaces, you can also
use the Management interface (either the physical interface, a subinterface (if supported for your model),
or an EtherChannel interface comprised of Management interfaces (if you have multiple Management
interfaces)) as a separate management interface. You cannot use any other interface types as management
interfaces.
If your model does not include a Management interface, you must manage the transparent firewall from
a data interface.
In multiple context mode, you cannot share any interfaces, including the Management interface, across
contexts. To provide management per context, you can create subinterfaces of the Management interface
and allocate a Management subinterface to each context. Note that the ASA 5512-X through ASA
5555-X do not allow subinterfaces on the Management interface, so for per-context management, you
must connect to a data interface.
For 8.4(1) and later, the management interface is not part of a normal bridge group. Note that for
operational purposes, it is part of a non-configurable bridge group.
Note
In transparent firewall mode, the management interface updates the MAC address table in the same
manner as a data interface; therefore you should not connect both a management and a data interface to
the same switch unless you configure one of the switch ports as a routed port (by default Cisco Catalyst
switches share a MAC address for all VLAN switch ports). Otherwise, if traffic arrives on the
management interface from the physically-connected switch, then the ASA updates the MAC address
table to use the
management interface to access the switch, instead of the data interface. This action
causes a temporary traffic interruption; the ASA will not re-update the MAC address table for packets
from the switch to the data interface for at least 30 seconds for security reasons.
No Support for Redundant Management Interfaces
Redundant interfaces do not support Management slot / port interfaces as members. You also cannot set
a redundant interface comprised of non-Management interfaces as management-only.
Management 0/0 Interface on the ASA 5512-X through ASA 5555-X
The Management 0/0 interface on the ASA 5512-X through ASA 5555-X has the following
characteristics:
•
No through traffic support
•
No subinterface support
•
No priority queue support
•
No multicast MAC support
•
The IPS SSP software module shares the Management 0/0 interface. Separate MAC addresses and
IP addresses are supported for the ASA and IPS module. You must perform configuration of the IPS
IP address within the IPS operating system. However, physical characteristics (such as enabling the
interface) are configured on the ASA.