I have an issue where we have a Management Server in a DC, which should manage 2 firewall clusters that are on remote locations.
Since there is no VPN-Tunnel between the DC and the foreign sites, we would prefer to manage them via public IP.
I've done the initial setup, created a static NAT to a public IP on the DC-FW (Cisco) for the mgmtsrv (192.168.1.1 <->220.127.116.11).
I'm able to install policies and make configuration changes, and also to fetch the policy vice versa.
Now since the setup is ready for further configuration and testing, I realized that I'm missing the logs from the remote clusters.
I checked all the logging settings in SC, they seem fine (mainly default).
The only thing that bothers me is the IP of the MGMT server. The main address of mgmtsrv is 192.168.1.1.
I assume that the GWs may try to send logs to the 192.168.1.1 IP, since the server itself doesn't really know that it is behind a public IP of 18.104.22.168. Normally there is a NAT-Option in the MGMT properties, which you can use to add a static NAT to the managed GWs.
But since my server is "natted" by the Cisco ASA, I don't think that these settings for a static NAT are right. I assume if my Cisco ASA would be a CP, then this would be right and the server would communicate it's public NAT IP to the remote GWs, so they send the logs to the correct public address. But in this case I see no option where I could tell the server, that it should communicate it's IP as "22.214.171.124" to the GWs, because it's manually natted on the ASA.
Otherwise - would it be possible to create a new server object with the IP 126.96.36.199 and add it to the log servers for the GWs?
It's just a bit ugly to have 2 mgmtsrv in the dashboard where one serves as "IP-Dummy"... but if it works, I'd take it 🙂
But maybe I'm completely wrong and there's another issue that I'm not aware of.
I'm thankful for any hints 🙂
P.S: Communication between GWs and mgmtsrv is allowed bidirectional on all ports.