Hi community, I'm looking for some guidance...
We're relatively new to FTD devices and in the progress of upgrading from legacy ASA 5008x's that were managed independently.
We have deployed an FMCv and are managing a new HA instance consisting of 2 x 1010 NGFW's. These devices exist at the same site as the FMC and are connected to FMC via the management interface.
We're now looking to deploy 2 x 1010 NGFW's in HA to each of our branch sites (x3). I've been trying to determine how to achieve remote management. Having read this, Cisco Firepower 2100 Getting Started Guide - Threat Defense Deployment with a Remote Management Center [Cisco Firepower 2100 Series] - Cisco it states "High Availability is not supported. You must use the Management interface in this case".
The issue we have is that the NGFW HA pair will be providing the site-2-site VPN back to the site that hosts the FMC. Documentation suggests that any configuration apart from interface configuration will be erased as part of the enrolment to FMC.
I believe we're in the chicken & egg scenario - I need the VPN tunnel up for the 1010's to access the FMC but in doing so, will erase the VPN configuration.
FYI - Pre-configuration isn't really feasible as the FMC is based in the UK. The branch sites are another UK site, 1 in each of the US & APAC. I don't even want to consider the issues of exporting devices out of the UK let alone support issues.
Anyone come across this scenario that can shed some light?
Thanks in advance!
