cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

13076
Views
70
Helpful
27
Replies
Stuart-ITGL
Beginner

FMC to remote FTD deployment

Want to deploy an ASA5506-X (running FTD v6.2.2) to a remote site and then be able to set up and manage a Site-to-Site VPN back to HQ where FMC server is located.

 

A) Is this even possible?

B) What is the best way to do this?

 

Remote FTD -----> Internet -----> HQ --> FMC

27 REPLIES 27

You cannot configure NAT via cli (ssh session - never use telnet).

 

If you configure via local manager (FDM) and then change to remote manager (FMC), the configuration is lost.

Has this issue been "fixed" or addressed in newer versions of code (like anytime after 6.4?).  Curious as I will be running up against this as well.

Alex Martin
Beginner

Did you attempt this as of yet and if so, which method did you use?  I have the same scenario and I wanted to see if one method is better than the others.  On top of what you have listed, my FTD in the remote site is the device that is doing the VPN for the networks behind it, so I can't/won't be relying on MPLS or some other VPN device for reachability. 

I'm still in the process of trying to get the FMC to talk to our 2110s, but we used public IP's on the FTD2110 management ports. The latest FTD patch (6.2.2.2) is supposed to allow you to lock down access to the mgmt, but upgrading to it breaks the access between FMC and FTD.


Simply stated, you cannot do the same process with FTD as we can with ASA/FirePower which sucks.  To do so either requires tricky setup, which is dangerous if you have problems down the road at your remote site, or requires more hardware.  Maybe this is by design now.  Either way you cannot simply add a locally managed FTD to a FMC at your main site.  I know that the features parity are not the same yet, but I sure hope this is resolved down the road.

 

https://supportforums.cisco.com/t5/firesight-system-3d-system/ftd-registering-to-fmc-scenario/td-p/2998213

 

cloudworks
Beginner

While I agree that this article does provide a way to deploy the remote firewalls, I do not suggest using this method. This puts your mgmt. interface behind the firewall you are trying to manage and can cause serious issues if you make a mistake in your deployment, rendering you "dead in the water" until you can get console access to reverse your errors. I highly suggest using a public IP on the mgmt port independent of the outside interface and locking down the access on mgmt. This will require the site to have 2 free public IPs, otherwise I would not recommend using these firewalls for remote deployments.


Any further traction on how to's on this?  We are looking to encrypt this connection via IPSec.  Running a ASA code with an SFR module is not an option and we will look at other vendors.  

Note that the connection between and FTD device and the managing FMC is already encrypted (TLS running over tcp/8305).

 

If you do a packet capture on the flow you will see it does an SSL/TLS handshake and uses the respective certificates from FMC and the FTD device to setup a secure channel for management and eventing.

 

Very true. I've setup many networks where the FMC and FTD are located in separate continents. Whilst the FP Management/Event Comms are encrypted, stick to security by design and use an MPLS or VPN between the two networks.

Alan Ng'ethe
Participant

Losing sleep over this problem too.

Remember to rate helpful posts and/or mark as a solution if your issue is resolved.
andreab789
Beginner

Hi Stuart,

Here's a workaround:

- configure the management with the public IP address and connect it to internet

- when you add the manager configuration don't forget to add the nat-id: "configure manager add x.x.x.x registration-key nat-id"

- when you add the FTD on the FMC DO NOT SET the FTD IP address but just the registration-key and nat-id, so the FMC will wait for the FTD to connect back

- once the FTD is connected, push the configuration with the real WAN/LAN ip addresses/routes/acls/nats. Since the management works on a sort of vrf, there will be no conflict

- connect the FTD WAN interface to INTERNET

- connect both FTD LAN and MANAGEMENT interface to the internal switch

- configure the routing on the switch

- re-configure the FTD management via the CLI: "configure network ipv4 manual x.x.x.x y.y.y.y z.z.z.z"

- the management traffic will be routed to the switch, go back to the INSIDE, get natted behind the OUTSIDE out to internet

- enjoy

 

WHILE THIS IS NOT A CISCO CERTIFIED PROCEDURE, IT DOES WORK IF YOU FOLLOW ALL THE ABOVE STEPS.

 

Screenshot 2020-09-08 at 14.02.27.png

 

Ciao!

Andrea

CCIE #60810
Ruben Cocheno
Enthusiast

It's possible today with the latest code, but use the external IP of the FMC to manage your remote FTD. You don't want to get locked out, reimage the box.

Please mark it helpfull if it was the case, and i have this problem too. Double touchdown is amazing. Thanks to make Engineering easy.