topic Adding IPS located on a remote site in Network Security

Adding IPS located on a remote site

seckka21 — Sat, 18 Jun 2022 16:43:23 GMT

Hello
I have a problem to manage the devices of two sites. I have my FMC installed on the main site with a management network 172.16.30.0/28. The FMC has an address in this network as well as the ips module and the interfaces of management of ASAs. My ips modules are registered on the FMC correctly. However, I have ASA 5525-Xs on another site and I want the same FMC to manage them. The two sites are connected by VPN. I want to create a network of management in this site for the ips and the management interfaces of the ASAs. Can the registration be successful since this equipment is on a remote network and is connected to the headquarters by vpn

Re: Adding IPS located on a remote site

MHM Cisco World — Sun, 19 Jun 2022 00:59:53 GMT

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/215442-configure-anyconnect-management-vpn-tunn.html

check this doc.

Re: Adding IPS located on a remote site

seckka21 — Sun, 19 Jun 2022 09:47:35 GMT

i have the vpn already set but my problem is that the fmc is in a different network with ips.Is it possible to add the the sensor?

Re: Adding IPS located on a remote site

Sheraz.Salim — Sun, 19 Jun 2022 10:32:43 GMT

FMC is on 172.16.30.0/28. and on another remote side ASA 5525-X SFR (Firepower sensor on different subnet). your requirment is to add the SFR IP address so it can register to FMC. You mentioned you alrady have Site-To-Site vpn establish between two. All need here is put the FMC ip address and SFR address in the crypto-map (plus the NAT rule exemption) on site HQ and the remote site. vice-versa on remote side put the crypto map for the address of SFR and FMC in the tunnel. this will reslove the issue and you will be able to register your SFR module to FMC.

FMC-HQ

nat(inside,outside) source static FMC FMC destin static SFR SFR no proxy-arp route-lookup

Remote-Site

nat(any,outside) source static SFR SFR destin static FMC FMC no proxy arp route lookup.