A security engineer is adding three Cisco FTD devices to a Cisco FMC. Two of the devices have successfully registered to the Cisco FMC. The device that is unable to register is located behind a router

Reconfiguring FMC to use the device's private IP address would not work, as the FMC cannot directly reach the private IP through the NAT device.

When a managed device is behind a NAT device, a NAT ID configured on both the FTD and FMC provides a unique identifier for establishing and maintaining the secure communication tunnel, allowing FMC to communicate with the FTD despite IP address translation.

Adding a port number for PAT to the device's IP address in FMC is not the correct mechanism for FTD registration behind NAT; the NAT ID feature is designed for this purpose.

Reconfiguring FMC to use a hostname does not resolve the underlying NAT translation issue for communication tunnel establishment.

If a registration attempt failed or the device was previously defined with an unreachable private IP in FMC, removing the existing IP address definition ensures a clean slate for the registration process with the NAT ID.