Sending a management request in a NAT deployment

Administrators can send a request to add the appliance to the Central Management System appliance. A rendezvous process enables the appliance to attempt the request and allows the Central Management System administrator to see the list of pending requests.

Requirements for establishing a successful connection

To send a management request and successfully establish and maintain the connection, the following must be in place:

Automatic rendezvous attempts are enabled on the requesting Network Security appliance (disabled by default).
The auto connect feature is enabled on the requesting Network Security appliance so it automatically tries to connect to the Central Management System appliance after the rendezvous attempt succeeds (enabled by default).
Note
See Preparing an Network Security appliance to send a management request in a NAT deployment to verify and enable these settings.

The Network Security appliance has a unique and permanent hostname. Pending requests from appliances with the same hostname or IP address will be rejected. If the hostname is changed, the connection will be broken and cannot be reset. If this happens, the appliance must be removed from the Central Management System appliance and then added again using the new hostname.
The Central Management System appliance and the Network Security appliance have the same rendezvous service name. The rendezvous process has an identifier (known as service name) that is set to "cmc" by default. The Central Management System appliance and the requesting appliance must have the same service name; if you change the service name on one, you must change it on the other as well. The cmc rendezvous service-name <hostname> command changes the service name; the no cmc rendezvous service-name command restores the default value. For details, see the CLI Command Reference.
Important
Appliance-initiated connections are not supported in Central Management System high availability (HA) deployments.

Prerequisites

Operator or Admin access
Network address translation (NAT) mapping, as described in Address mapping
If the requesting appliance is behind a NAT gateway: The virtual NAT address and port that map to the requesting appliance internal IP address and SSH port
If the Central Management System appliance is behind a NAT gateway:
- The virtual NAT address and port that map to the Central Management System internal IP address and SSH port
- One of the following:
  - The accessible Central Management System IP address and port, described in Configuring and activating an accessible DTI server address
  - Single-port communication enabled on the appliance, described in Changing the address type for DTI network service requests

Preparing an Network Security appliance to send a management request in a NAT deployment

Use the commands in this section to prepare an appliance in a NAT deployment to send a request for management to the Central Management System appliance.

To prepare to send a request:

Go to CLI configuration mode:

appl-hostname > enable
appl-hostname # configure terminal

Enable automatic rendezvous attempts:
```
appl-hostname (config) # cmc rendezvous client auto
```
Important
After automatic rendezvous is enabled, when the requesting Network Security appliance is behind a NAT gateway, the local IP address of the appliance will be included in the request instead of the mapped address. You must prevent the local IP address of the appliance from being part of the request, and then force the request to be sent again using the mapped address. These commands are included in the relevant procedures.
Verify that the auto connect feature is enabled:
1. View Network Security (client) information:
```
appl-hostname (config) # show cmc client
```
2. If Autoconnect: no is shown, enable auto connect:
```
appl-hostname (config) # cmc client connection auto
```
Save your changes.
```
hostname (config) # write memory
```

Sending a management request in a NAT deployment using the appliance Web UI

Use the Add to CM page in the Network Security Web UI to initiate a request to be added to a Central Management System appliance.

To send a management request:

Note
If the appliance has never sent a management request, ensure that it meets the requirements described in Preparing an appliance to send a management request in a NAT deployment.

Log in to the requesting Network Security appliance Web UI.
Click the Settings tab.
Click CM Network on the sidebar.
In the CM IP Address and Port boxes, do one of the following:
- If the Central Management System is not behind a NAT gateway or is behind the same NAT gateway as the appliance: Enter the Central Management System IP address and remote management port. The default port is 22.
- If the Central Management System is behind a NAT gateway different from the appliance NAT gateway: Enter the accessible Central Management System IP address and port.
In the CM Username and CM Password boxes, enter the admin credentials the appliance should use to log in to the Central Management System appliance to announce itself.
If the Network Security appliance is behind a NAT gateway, select the Appliance Behind NAT checkbox.
Click Send Request.
A message informs you that the request succeeded or failed, or that the appliance is already being managed by the Network Security appliance. If the request succeeded, a Central Management System administrator can accept or reject the request. An example success message is shown below:
Note
See the Central Management System Administration Guide for information about accepting the requests and adding the appliances to the Central Management System appliance.

Sending a management request in a NAT deployment using the Network Security CLI

Use the commands in this section to send a management request from an Network Security appliance in a NAT deployment to the Central Management System appliance.

The following topologies are supported:

Caution
If the Network Security appliance has never sent a management request, ensure the requirements described in Preparing an Network
Security appliance to send a management request in a NAT deployment are in place before you attempt to send the request.

Central Management System and Network Security appliance behind the same NAT gateway

To send a management request:

Go to CLI configuration mode:

appl-hostname > enable
appl-hostname # configure terminal

Specify the hostname, or IPv4 or IPv6 address of the Central Management System appliance:
```
appl-hostname (config) # cmc client server address <hostname, IPv4 or IPv6 address>
```
Specify the authentication type and admin credentials the appliance should use to log in to the Central Management System appliance to announce itself.
```
appl-hostname (config) # cmc client server auth authtype <authType>
appl-hostname (config) # cmc client server auth <authType> username <username>
appl-hostname (config) # cmc client server auth <authType> password <password>  | identity <identity>
```
where <authType> can be password, ssh-dsa2, or ssh-rsa2. (See Configuring User Authentication Using the CLI for details.)
Save your changes.
```
appl-hostname (config) # write memory
```

Network Security appliance behind NAT gateway and Central Management System in external network

To send a management request:

Go to CLI configuration mode:

appl-hostname > enable
appl-hostname # configure terminal

Specify the hostname, or IPv4 or IPv6 address of the Central Management System appliance:
```
appl-hostname (config) # cmc client server address <hostname, IPv4 or IPv6 address>
```
Specify the authentication type and admin credentials the appliance should use to log in to the Central Management System appliance to announce itself.
```
appl-hostname (config) # cmc client server auth <authType> 
appl-hostname (config) # cmc client server auth <authType> username <username>
appl-hostname (config) # cmc client server auth <authType> password <password> | identity <identity>
```
where <authType> can be password, ssh-dsa2, or ssh-rsa2. (See Configuring User Authentication Using the CLI for details.)
Prevent the local IP address of the appliance behind the NAT gateway from being part of the request:
```
appl-hostname (config) # no cmc rendezvous client send-client-address
```
Save your changes.
```
appl-hostname (config) # write memory
```

Central Management System behind NAT gateway and Network Security appliance in external network

To send a management request:

Go to CLI configuration mode:

appl-hostname > enable
appl-hostname # configure terminal

Specify the virtual NAT hostname, or IPv4 or IPv6 address and port that are mapped to the Central Management System internal IP address and SSH port:
```
appl-hostname (config) # cmc client server address <hostname, IPv4 or IPv6 address>
```
where <IPv4 or IPv6 address> is the mapped IPv4 or IPv6 address.
(Optional) Specify the virtual NAT port that is mapped to the Central Management System internal SSH port:
```
appl-hostname (config) # cmc client server port <port>
```
The port defaults to 22 if it is not specified.
Specify the authentication type and admin credentials the appliance should use to log in to the Central Management System platform to announce itself.
```
appl-hostname (config) # cmc client server auth <authType> 
appl-hostname (config) # cmc client server auth <authType> username <username>
appl-hostname (config) # cmc client server auth <authType> password <password> | identity <identity> 
```
where <authType> can be password, ssh-dsa2, or ssh-rsa2. (See Configuring User authentication using the CLI for details.)
Save your changes.
```
appl-hostname (config) # write memory
```

Central Management System and Network Security appliances behind different NAT gateways

To send a management request:

Go to CLI configuration mode:

appl-hostname > enable
appl-hostname # configure terminal

Specify the virtual Central Management System NAT hostname, or IPv4 or IPv6 address that is mapped to the Central Management System internal IP address:
```
appl-hostname (config) # cmc client server address <hostname, IPv4 or IPv6 address>
```
where <IPv4 or IPv6 address> is the mapped IPv4 or IPv6 address.
(Optional) Specify the virtual Central Management System NAT port that is mapped to the Central Management System internal SSH port:
```
appl-hostname (config) # cmc client server port <port> 
```
The port defaults to 22 if it is not specified.
Specify the authentication type and admin credentials the appliance should use to log in to the Central Management System platform to announce itself.
```
hostname (config) # cmc client server auth authtype <authType>
hostname (config) # cmc client server auth <authType> username <username>
hostname (config) # cmc client server auth <authType> password <password> |  identity <identity>
```
where <authType> can be password, ssh-dsa2, or ssh-rsa2. (See Configuring User Authentication Using the CLI for details.)
Prevent the local IP address of the appliance behind the NAT gateway from being part of the request:
```
appl-hostname (config) # no cmc rendezvous client send-client-address
```
Send the request again without including the local IP address of the appliance:
```
appl-hostname (config) # cmc rendezvous client force
```
Save your changes.
```
appl-hostname (config) # write memory
```