How Does an FTD Behind a PAT Router Register to Cisco FMC?

Configure devices using Secure Firewall Management Center

Answer Correct answer: B, D — Configure a matching NAT ID on both the Cisco FMC and the FTD, and leave the device IP address blank in the FMC so registration proceeds over PAT.

A security engineer is adding three Cisco FTD devices to a Cisco FMC. Two of the devices have successfully registered to the Cisco FMC. The device that is unable to register is located behind a router that translates all outbound traffic to the router’s WAN IP address. Which two steps are required for this device to register to the Cisco FMC? (Choose two.)

Reconfigure the Cisco FMC to use the device’s private IP address instead of the WAN address.
Configure a NAT ID on both the Cisco FMC and the device. Correct Answer
Reconfigure the Cisco FMC to use the device’s hostname instead of IP address.
Remove the IP address defined for the device in the Cisco FMC. Correct Answer
Add the port number being used for PAT on the router to the device’s IP address in the Cisco FMC.

Community Insight

The exam tests how FMC authenticates a managed device when its real IP is hidden behind PAT — identity must come from a NAT ID rather than an IP address, and the trap is assuming FMC can still be pointed at a private address or a translated port.

Registering a Cisco FTD that sits behind a PAT/NAT router requires a shared NAT ID between the device and Cisco FMC plus leaving the device's IP address blank in FMC. This page confirms options B and D as the two required steps and explains why reconfiguring FMC with a private IP, hostname, or PAT port fails.

Choosing option A (point FMC at the device's private IP address) or option C (use the hostname), because both assume FMC can reach the device directly — but the router performs PAT, so no inbound mapping to the device exists and the private address is unroutable from FMC.

Community Discussion (14 comments)

donciga 👍 1 Selected: BD

B and D When the FTD is behind a router that PATs all outbound traffic to one WAN IP, the FMC cannot open a unique connection to that device’s private address. Registration then uses a shared NAT ID:On the FTD: configure manager add <FMC_IP_or_DONTRESOLVE> <reg_key> <nat_id> On the FMC Add Device dialog: enter the same registration key and NAT ID, and leave the device IP address empty (or do not use the private/WAN address as a reachable host). The FTD initiates the sftunnel; the NAT ID ties the connection to the correct device.

Happy_Shepherd26 👍 1 Selected: BD

For instance, when you add a device to the Cisco FMC, and you do not know the device IP address (or the device is behind a NAT/PAT device), you specify only the NAT ID and the registration key on the FMC and leave the IP address blank

Demon_Queen_Velverosa 👍 2

The best answer is B and C. The Demon Queen provides the following from the official cert guide. When you add a managed device to the Cisco FMC, you must provide an IP addresses of the managed device along with a registration key for authentication. The Cisco FMC and the managed device use the registration key and a NAT ID (instead of IP addresses in the case that the device is behind NAT) to authenticate and authorize for initial registration. For instance, when you add a device to the Cisco FMC, and you do not know the device IP address (or the device is behind a NAT/PAT device), you specify only the NAT ID and the registration key on the FMC and leave the IP address blank

MB2222 👍 1

Wouldn't it be answers (A) and (B)... Please refer to: https://community.cisco.com/t5/network-security/connect-ftd-to-fmc-with-nat-at-both-sides/td-p/3726411

Kris92 👍 6 Selected: BD

PAT lets you use a single public IP address and unique ports to access the public network; these ports are dynamically assigned as needed, so you cannot initiate a connection to a device behind a PAT router. Normally, you need both IP addresses (along with a registration key) for both routing purposes and for authentication: the FMC specifies the device IP address when you add a device, and the device specifies the FMC IP address. However, if you only know one of the IP addresses, which is the minimum requirement for routing purposes, then you must also specify a unique NAT ID on both sides of the connection to establish trust for the initial communication and to look up the correct registration key. The FMC and device use the registration key and NAT ID (instead of IP addresses) to authenticate and authorize for initial registration. https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/device_management_basics.html

Stevens0103 👍 4 Selected: BD

It's B & D. 100% guarantee. "For example, you add a device to the FMC, and you do not know the device IP address (for example, the device is behind a PAT router), so you specify only the NAT ID and the registration key on the FMC; leave the IP address blank. On the device, you specify the FMC IP address, the same NAT ID, and the same registration key. The device registers to the FMC's IP address. At this point, the FMC uses the NAT ID instead of IP address to authenticate the device." https://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Device_Management_Basics.html

al1 👍 2

B&D is correct Version 7.3 https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/730/management-center-device-config-73/get-started-device-management.html In the NAT Environment Topic It says, " Although the use of a NAT ID is most common for NAT environments, you might choose to use the NAT ID to simplify adding many devices to the management center. On the management center, specify a unique NAT ID for each device you want to add while leaving the IP address blank, and then on each device, specify both the management center IP address and the NAT ID. Note: The NAT ID must be unique per device."

c946f3e 👍 2

configure manager add {hostname | IPv4_address | IPv6_address | DONTRESOLVE } regkey [nat_id] [display_name] {hostname | IPv4_address | IPv6_address}—Sets the management center hostname, IPv4 address, or IPv6 address. DONTRESOLVE —If the management center is not directly addressable, use DONTRESOLVE instead of a hostname or IP address. If you use DONTRESOLVE , then a nat_id is required. When you add this device to the management center, make sure that you specify both the device IP address and the nat_id ; one side of the connection needs to specify an IP address, and both sides need to specify the same, unique NAT ID. Example: > configure manager add DONTRESOLVE abc123 efg456 Manager successfully configured. Please make note of reg_key as this will be required while adding Device in FMC. >

Initial14 👍 3

If you are registering device that is behind NAT, on FMC you must: specify a unique NAT ID for each device you want to add while leaving the IP address blank, and then on each device, specify both the management center IP address and the NAT ID. Note: The NAT ID must be unique per device. On FTD you: configure manager add [manager IP] regk3y78 natid56 In the case when FTD is with public address and FMC is behind NAT: specify a unique NAT ID per device on both the management center and the devices, and specify the device IP addresses on the management center. on FTD: onfigure manager add DONTRESOLVE regk3y78 natid90 If the threat defense is behind a NAT device, enter a unique NAT ID along with the management center IP address or hostname, for example: > configure manager add 10.70.45.5 regk3y78 natid56

artgen 👍 2

So according to this the answer provided is correct, so B&D

Initial14 👍 2

Te upper comment is for FTD registering to FMC. When you register device that is behind NAT , on FMC you leave IP address blank, only use Custom NAT ID: On the management center, specify a unique NAT ID for each device you want to add while leaving the IP address blank, and then on each device, specify both the management center IP address and the NAT ID. Note: The NAT ID must be unique per device.

Joe_Blue 👍 7 Selected: AB

Assuming that the devices are communicating over the Internet, the following two steps are required for the device to register to the Cisco FMC: A. Reconfigure the Cisco FMC to use the device’s private IP address instead of the WAN address. This will allow the Cisco FMC to reach the device even though its IP address is being translated by the router. B. Configure a NAT ID on both the Cisco FMC and the device. This is necessary to allow the Cisco FMC to identify the device behind the NAT device and to establish a secure connection.

Kris92 👍 2

this is NOT correct and A and B contradict themselves, either you use the real IP or the NAT IP? Joe_Blue seems to be generating his answers from ChatGPT, from my experience they are sometimes true, but not reliable.

Initial14 👍 1

You are right: Cisco's WP regarding this : https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/730/management-center-device-config-73/get-started-device-management.html

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Cisco's device-management documentation states that when a managed device is behind NAT you add it to the management center using a unique NAT ID while leaving the device IP address blank, and on the device itself you supply the management center's reachable address, the registration key, and the same NAT ID. Option B captures the first half — the NAT ID must exist on both the FMC object and the FTD (via the configure manager add command's nat_id argument) so the two sides can match the registration handshake without relying on an IP address. Option D captures the second half — the IP address field for that device in the FMC must be cleared, because PAT assigns the router's WAN address and a dynamically chosen port, making any statically entered address wrong. Together they let the FTD initiate the connection outbound and prove its identity with the NAT ID and registration key.

Why the Other Options Are Wrong

Option A is wrong because entering the device's private IP address does not make it routable from the FMC; PAT performs port-level translation and there is no static inbound path back to that private address, which is exactly why the NAT ID mechanism exists as an alternative to IP-based identification. Option C fails for the same reason — the FMC does not resolve an FTD's hostname across a PAT boundary, and Cisco's guidance is to leave the address blank rather than substitute a name; the DONTRESOLVE keyword applies to the device side when the FMC is not directly addressable, not as a fix for the FMC's device record. Option E is a classic distractor: the PAT source port is assigned dynamically per flow, so it cannot be appended to the device entry as a stable identifier.

Community Comment Notes

Several learners converged on the same pair of steps. Kris92 explained that because PAT dynamically assigns ports, "you cannot initiate a connection to a device behind a PAT router," which is why identity has to come from something other than address and port. Stevens0103 guaranteed B and D and quoted the guidance that you "specify only the NAT ID and the registration key on the FMC; leave the IP address blank." Initial14 gave the same operational recipe — a unique NAT ID per device on the FMC with the IP blank, and the management center IP plus NAT ID on the FTD — and al1 cited the Cisco device-management page, where the NAT Environment topic is documented. Joe_Blue's AB pick drew a direct rebuttal from Kris92, who pointed out that A and B contradict each other and that such answers, while sometimes plausible, are not reliable.

One dissenting voice, Demon_Queen_Velverosa, argued for B and C from a cert guide, but that reading conflicts with the vendor text that requires the FMC device entry to have no IP address when the device is behind NAT.

Official Reference

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/730/management-center-device-config-73/get-started-device-management.html

Exam Strategy

Memorize the symmetric pairing: FMC gets the NAT ID with a blank IP, the FTD gets the FMC address, registration key, and the same NAT ID. Any option that tries to fix NAT registration by pointing at a private IP, a hostname, or a specific PAT port is a distractor.

Frequently Asked Questions

Why can't the FMC just use the FTD's private IP address to register a device behind PAT?

The router performs port address translation, so the private address is not routable from the FMC and no inbound mapping exists. Registration must instead be matched by a shared NAT ID.

Why is adding the PAT port number to the device IP in the FMC wrong?

PAT assigns source ports dynamically per flow, so the port is not a stable identifier. The FMC authenticates the device with the NAT ID and registration key, not an address-plus-port pair.

More 300-710 FAQ →

Related Analysis

← Back to 300-710 Study Guide