Remote management has been broken since FTD came out - it's one of the main reasons we haven't deployed FTD for our customers yet. (We're an MSSP - managing remote customers is what we do, and it's frustrating that Cisco never bothered testing the process during design.) For ASA hardware, we use split-image ASA+FP, so we can set up the ASA to do NAT (using CLI to configure the ASA's management interfaces, then either CLI or ASDM to set up NAT), and then use the NAT to reach the FP management port. But with FTD we can't do that - you need the remote manager to set up the NAT, but you need the NAT to access the remote manager, and CLI doesn't help.
So besides ranting, here's what choices we've documented
- Some of our customers have dedicated management networks, over MPLS or other VPN tunnel devices, and we use those. That's mostly common in data centers. It's way overkill for a 5506.
- Some of our customers have routers with spare ports, or switches that have spare ports so we can access the router, so depending on who manages them, we could do NAT on the router to reach the FTD management port. The switch in between makes more sense in an HA environment (where we'd already be using switches), but it's more awkward if the data pipes are 10Gbps (where we'd need to put in a 1Gbps interface also) than if it's all 1Gbps.
- We're NOT going to put in a $50 Linksys firewall next to the management port on a multi-$100K 9300. It just looks dumb. But we might put in a 3G/4G wireless device if the customer's location allows that and has a reliable signal, or some fancier Out-Of-Band device that also provides a serial connection.
Do you know whether FTD shares the ASA's "feature" that the management port can't be in the same subnet as the Outside data interface? Combining all the management and Outside data into the same subnet means we don't need NAT to support them all. (I used to know, but it's been a while and it was something I only found out the hard way, not from reading documentation.)
