ASA-FTD Register to FMC

[fatalXerror]

Hi Guys,

I just initially configured my FTD in my remote-site and I put my management's gateway as the data interface as there is an option in FDM for it. Now, I can reach the management ip using icmp whenever I am coming from outside however, I cannot access its ssh or https. FYI, I did not connect any cables to the physical management port.

Now, I want to manage the FTD using my FMC located outside the premises. My question is, it is possible to this way what my management traffic is passing via my data interface or I do really need to pass it via the physical management port?

I have read so many guides or articles about this but I did not saw any something like my scenario.

Thank you for the help.

[Mohammed al Baqari]

You can manage it using data interface.

[fatalXerror]

But in FMC, I will still call my management IP right not the outside IP?

[Marvin Rhoads]

FMC-FTD communications are to the FTD management interface. They may pass via the FTD data interface(s) but must terminate on the management interface. They require 2-way communications (e.g. both sides must be able to initiate) on tcp/8305.

[fatalXerror]

Hi Marvin,

Thanks for the feedback.

I can ping the management IP already via passing through data interface (outside) however, I cannot access FDM nor SSH on it and I already allowed it in the management access-list via data interface.

I was just wondering, if I cannot access FDM nor SSH using that way maybe integrating to FMC is not applicable also?

Thanks

[Marvin Rhoads]

Well you need to be able to reach FMC from your FTD management interface (and vice versa) on tcp/8305 for registration to succeed. 

You mentioned FDM - if you are using FDM (local manager) then you cannot also use FMC (remote manager). You'd need to remove local management first.

In general, please see the attached troubleshooting guide - there is a section at the bottom for troubleshooting registration failures.