FTD w/FMC S2S vpn tunnel not working

[gnguyen89]

All, 

    I swapped out my old ASA with FTD using the same ip addresses for inside outside.  Since we are in the US and remote site is in Singapore.  Once the support person swaps out the ASA for the FTD I can still see the remote side network.  I can ping the gateway to the local network 10.28.100.1 I can ping the inside interface to the ftd which is 10.28.100.11, and I can ping/ssh to the management which is 10.28.100.5.  The problem is the FMC can no longer see the ftd once I switch it from the ASA so I no longer deploy anything.  When the ASA is connected back again I can manage the FTD through the management interface.  Any suggestions will be appreciated. Thank you.

[gajownik]

If I understand you correctly you want to manage FTD via S2S tunnel that is terminated on the same FTD that you want to manage?
If yes this design is against best practices and and prone to errors leading to cutting of from the device. We had lots of cases in TAC where due to user misconfiguration or bug in software tunnel went down and without TAC assistance it was not possible to fix it (normal deployment is broken).

CSCwb41698 DOC BUG: add note to FMC Device Configuration Guide not to manage device over VPN tunnel
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwb41698

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/policy_management.html#ID-2176-0000040d

"You can deploy the FMC policy configuration over a VPN tunnel, only if the deployment is for a device that does not terminate the tunnel. The FMC to Firepower Threat Defense management traffic should be its own secure transport SF tunnel and does not need to be over S2S VPN tunnel for any connectivity."

Your setup probably does not work due to missing "management-access" which depending on the FTD version might not work properly, but as I said it's not a proper design.

[gnguyen89]

Thank you for the information that does make sense.  I am trying to find a solution to swapping out the ASAs (with Firepower 1 and 2) would the following work if I had another firepower tunnel going to London would I be able to send the management going to Houston over this tunnel and vice versa for the London management?  Or would you recommend not managing the firepower with the FMC but through the FTD locally instead?  I've attached a drawing for reference. 

 

 

[MHM Cisco World]

So you need outside to be end of s2s vpn and in same time used for connect fpr to fmc (note new fpr accpet data interface to be mgmt interface so no need access mgmt).

This work but you need to make sure that in Singapore (FMC) site use NAT (to public) hence fpr in London and Houston can connect FMC directly without pass over s2s.