Hi all,
I’m working on integrating Cisco Firepower Management Center (FMC) with Microsoft Sentinel. We’ve set up a VM to pull logs from FMC and send them to Sentinel, but we're hitting a connection error that says:
The server is shutting down.
There has been a client authentication failure (please check that your outbound IP address matches that associated with your certificate - note that if your device is subject to NAT then the certificate IP must match the upstream NAT IP).
There is a problem with the server. If you are running FMC v6.0, you may need to install 'Sourcefire 3D Defense Center S3 Hotfix AZ 6.1.0.3-1'."
Our setup has an Azure firewall with NAT, and we suspect this error could be related to IP address mismatches between the public IP of the VM and the NAT IP as it reaches FMC.
Does anyone know how to confirm whether FMC is seeing requests from the VM’s public IP or the NAT-translated firewall IP? Any tips on specific logs or commands on FMC to check this would be incredibly helpful.
Thanks in advance for any advice or pointers!
