I know this question is questioned a lot, but i need help to understand the steps and configuration.
FMC ----> FTD-HQ -----> WAN ------> FTD-Remote
I need to understand the procedure.
1--> FMC_REAL_IP ----> FMC_NAT
2--> i need to configure mgmt inter on remote FTD with Public ip?
3--> how to configure NAT on cli in FTD remote?
Hey ipv6 here is a quick write up on what I did
1) On ASA STATIC NAT SOURCE FMC Service TCP\8305
2) ACE Outside Interface Source (Public IP Object for FTD) Destination FMC (Internal IP) Service TCP\8305
3)I staged FTD on same subnet over management interface by registering to the FMC on same subnet and configuring. So ex:
a)FTD configure network ipv4 192.168.2.10 255.255.255.0 192.168.2.1 DNS 22.214.171.124
b)Configure manager add 192.168.2.20 cisco123
4)Assigned ACP through registration and created NAT policy which is very important to apply to the FTD also prior to deploying to remote site. The reason is for me at least the only way I could get this to work was while staging the FTDon same subnet with FMC I had to de-register the FTD from the FMC prior to deploying to remote. The deregistration process leaves your Interface assigned IP's in place but removes the zones ACP and NAT it seems is also left in place so that once you get to remote you have internet access based on the applied dynamic nat inside to outside that was applied prior to deregistration.
5)I then changed management interface to an Ip address I would use on the remote subnet I was deploying to.
6) Consoled in then i configure network management-data by inputting the public IP address assignment for the remote FTD
7) Once I was at remote location with FTD I verified I could get internet then i consoled into the FTD and registered over the wan through 8305 which is being Nat'd through the headend ASA to the internal FMC for which will bring up 8305 once initiator requests to register (In this case the FTD is initiator) at this point you could expert cli on the FMC cli and do a netstat -na | grep 8305 to see established connection or if failing you could open up ASDM logging and filter by Pub IP of the FTD you are trying to register to the FMC with to see if getting FINS and issues and at least seeing that the remote FTD is getting to the ASA. If you didnt see traffic in the ASAlogs while registering the remote ftd then obviously issue down the line.
I could not find a way to stage my FTD completely and plug into the remote site without having to deregister from the FTD and reregistering over the WAN
I share my lab so we can understand better.
the part from HQ is configure and i can catch from internet router FMC NAT IP.
But my problem is the branch FTD, how to configure default route to internet router so i can catch FMC NAT?
I have try to configure also management-data-interface like this:
configure network management-data-interface ipv4 manual 126.96.36.199 255.255.255.240 default-gw 188.8.131.52 interface eth0.
Error: The Interface: eth0 is not configured with remote management.
i need to test here before i try on the production.
On FTD run
1 )Configure management-data-interface (Hit Enter at this point)
2)Type ethernet1/1 (This is the interface you want to configure) after typing ethernet1/1 hit enter which will prompt you through the remaining steps for you to enter your Public Ip info
6) 184.108.40.206 , 220.127.116.11 (Comma seperated list of DNS servers)
Step 2 Ex: Firewall in front of FMC Public IP address 18.104.22.168 (Has NAT established for service port tcp/8305 to inside FMC management IP address say 192.168.2.10)
From FTD CLI
Configure manager add 22.214.171.124 cisco123 natid123
FMC add device
(Select Tier of FMC if running 7.2 version)
(Asign to ACP and Licenses)
If your NAT is good then the FTD should be able to establish the connection using tcp\8305 with the internal FMC behind the NAT'd firewall 126.96.36.199 tcp\8305 ----> 192.168.2.10 FMC which will bring up as an established connection and allow for registration.
you can check FTD expert mode netstat -na | grep 8305 to see if connection established or on firewall in front of FMC bring up logging and filter by initiator IP address 188.8.131.52 to see if firewall in front of FMC sees it and determine any errors if there are some such as not putting the correct tcp\8305 port in your NAT statement etc