Just a preface that it is generally NOT a good idea to allow mgmt port access to the internet. If you do need to do this then you should set ip address restrictions so that only trusted subnets can attempt mgmt login.
Configuration > Admin > Permitted IPs
Be sure to add your internal network subnet first as these restrictions take place immediately
On your cr300i you will need to port forward either ssh or https to the NS5GT address.
On the NS5GT
allow mgmt on the interface - Network > interfaces > edit untrust and check the box for either ssh or http to allow mgmt