When global host-key authentication is enforced on the Central Management System appliance, you must obtain the public host key from managed appliance and import it into the Central Management System global host-keys database. This is described in Host-Key Authentication .
The managed appliance host-key string includes its IP address. If the managed appliance is in an internal network behind a NAT gateway, the IP address in the key string you obtain from the managed appliance Web UI or CLI must be replaced with the virtual IP address that is mapped to the managed appliance on the NAT gateway.
Example
In this example, the Email Security — Server appliance is behind the NAT gateway. Its IP address is 2.2.2.5, and its virtual IP address is 3.3.3.5.
.jpg "EX_Int_CM_Initiates_sp_v2.jpg")
The host-key string you obtain from the appliance Web UI or CLI starts with "2.2.2.5". For example:
2.2.2.5 ssh-rsa BEWDS4d65dj/T29+6a38loABAAABAQDZZJLE/ftkUddyNW6KdqEQXjS0Pjb
tzTn3OB51Qg0fdeQHrJgFHM2/4C9WtDkwuX5jd7gdWnSWYwrXDv657thlyRPIt4Wxjf0bpOolPKAe
...Before you import the host-key into the Central Management System global host-keys database, you must replace "2.2.2.5" with "3.3.3.5." For example:
3.3.3.5 ssh-rsa BEWDS4d65dj/T29+6a38loABAAABAQDZZJLE/ftkUddyNW6KdqEQXjS0Pjb
tzTn3OB51Qg0fdeQHrJgFHM2/4C9WtDkwuX5jd7gdWnSWYwrXDv657thlyRPIt4Wxjf0bpOolPKAe
...Note
This example is from an Email Security — Server appliance, but it is representative of Central Management System appliances as well.
.jpg "CM_Int_EX_Initiates_sp_v2.jpg")