You cannot configure NAT via cli (ssh session - never use telnet).
If you configure via local manager (FDM) and then change to remote manager (FMC), the configuration is lost.
Has this issue been "fixed" or addressed in newer versions of code (like anytime after 6.4?). Curious as I will be running up against this as well.
Did you attempt this as of yet and if so, which method did you use? I have the same scenario and I wanted to see if one method is better than the others. On top of what you have listed, my FTD in the remote site is the device that is doing the VPN for the networks behind it, so I can't/won't be relying on MPLS or some other VPN device for reachability.
Simply stated, you cannot do the same process with FTD as we can with ASA/FirePower which sucks. To do so either requires tricky setup, which is dangerous if you have problems down the road at your remote site, or requires more hardware. Maybe this is by design now. Either way you cannot simply add a locally managed FTD to a FMC at your main site. I know that the features parity are not the same yet, but I sure hope this is resolved down the road.
Any further traction on how to's on this? We are looking to encrypt this connection via IPSec. Running a ASA code with an SFR module is not an option and we will look at other vendors.
Note that the connection between and FTD device and the managing FMC is already encrypted (TLS running over tcp/8305).
If you do a packet capture on the flow you will see it does an SSL/TLS handshake and uses the respective certificates from FMC and the FTD device to setup a secure channel for management and eventing.
Very true. I've setup many networks where the FMC and FTD are located in separate continents. Whilst the FP Management/Event Comms are encrypted, stick to security by design and use an MPLS or VPN between the two networks.