300-710 · Question #228
An administrator is attempting to add a new FTD device to their FMC behind a NAT device with a NAT ID of NAT001 and a password of Cisco0420l06525. The private IP address of the FMC server is…
The correct answer is A. configure manager add 209.165.200.225 <reg_key> <nat_id>. To register an FTD to an FMC that is behind a NAT device, the configure manager add command must use the FMC's public IP address and include a NAT ID.
Question
An administrator is attempting to add a new FTD device to their FMC behind a NAT device with a NAT ID of NAT001 and a password of Cisco0420l06525. The private IP address of the FMC server is 192.168.45.45. which is being translated to the public IP address of 209.165.200.225/27. Which command set must be used in order to accomplish this task?
Options
- Aconfigure manager add 209.165.200.225 <reg_key> <nat_id>
- Bconfigure manager add 192.168.45.45 <reg_key> <nat_id>
- Cconfigure manager add 209.165.200.225 255.255.255.224 <reg_key> <nat_id>
- Dconfigure manager add 209.165.200.225/27 <reg_key> <nat_id>
How the community answered
(40 responses)- A88% (35)
- B3% (1)
- C8% (3)
- D3% (1)
Why each option
To register an FTD to an FMC that is behind a NAT device, the `configure manager add` command must use the FMC's public IP address and include a NAT ID.
When the Firepower Management Center (FMC) is behind a NAT device, the FTD must use the FMC's public IP address (209.165.200.225) to initiate the connection. The `configure manager add` command also requires a registration key and, in this scenario, a `nat_id` parameter ('NAT001') to inform the FMC that it is communicating via NAT, making the command `configure manager add 209.165.200.225 <reg_key> <nat_id>` correct.
The FTD cannot reach the FMC's private IP address (192.168.45.45) if the FMC is behind a NAT device and the FTD is connecting from outside the private network.
The `configure manager add` command syntax for the FMC IP address does not include a subnet mask in dotted-decimal format.
The `configure manager add` command syntax for the FMC IP address does not include CIDR notation (/27).
Concept tested: Cisco FTD registration to FMC behind NAT
Source: https://www.cisco.com/c/en/us/td/docs/security/firepower/ftd-config/620/ftd-nat-guide/device_registration.html
Topics
Community Discussion
No community discussion yet for this question.