Cisco Secure Firewall Management Center (formerly Firepower Management Center) Data Sheet

 

Security that works together

The Cisco Secure Firewall Management Center (FMC) is your administrative nerve center for managing critical Cisco network security solutions. It provides complete and unified management over firewalls, application control, intrusion prevention, URL filtering, and advanced malware protection. Quickly and easily go from managing a firewall to controlling applications to investigating threats and remediating malware outbreaks. It is a key part of the broad and integrated Cisco Secure portfolio, delivering in-depth analysis, streamlined security management across the network and cloud, and accelerated incident investigation and response, working across your Cisco and third-party technologies.

Comprehensive visibility and policy control

●     Provides exceptional visibility into what is running in your network and cloud so you can see what needs to be protected.

●     Rapidly detects suspicious/malicious traffic and quickly creates custom rules to prevent the attack from advancing.

●     Built in forensics give a detailed analysis of malware to safely remediate with a graphical representation of all the devices the attack has infected.

●     Creates firewall rules and controls thousands of commercial and custom applications used in your environment.

●     Shares context with Cisco Secure Workload, allowing firewalls in the network to be “workload aware” for better protection of dynamic applications everywhere in your environment.

●     Defines the intrusion prevention levels, URL reputation rules, and malware threat defense policies. It solves problems such as: “When network traffic is coming from a specific country using this particular application with a file attached, I can apply this level of intrusion inspection, analyze the file for malware, and send it to the integrated sandbox, if necessary.”

Automated security for dynamic defense

The Firewall Management Center continually monitors how your network is changing. It streamlines operations and improves your security by:

●     Automatically correlating and prioritizing new attack events with your network’s vulnerabilities to alert you to attacks that may have been successful. Your security team can focus on those events that matter the most.

●     Analyzing your network’s vulnerabilities and automatically recommending the appropriate security policies to put in place. You can adapt your defenses to changing conditions and implement security measures tailored specifically to your network.

●     Correlating specific events from network, endpoint, intrusion, and security intelligence sources. You are alerted if individual hosts show signs of compromise from unknown attacks.

●     Applying file policy criteria. If those are met, it automatically analyzes the file to identify known malware and/or sends the file to an integrated sandbox to identify unknown malware.

Centralized Event and Policy Manager

The Firewall Management Center is the centralized event and policy manager for:

●     Cisco Secure Firewall Threat Defense (FTD), both on-premises and virtual

●     Cisco Secure IPS (formerly Firepower NGIPS)

●     Cisco Firepower Threat Defense for ISR

●     Cisco Malware Defense (formerly Advanced Malware Protection, or AMP)

Enterprise-Class Management

The Firewall Management Center (FMC) discovers real-time information about changing network resources and operations. You get a full contextual basis for making informed decisions (Figure 1). In addition to providing a wide breadth of intelligence, FMC delivers a fine level of detail, including:

●     Trends and high-level statistics. This information helps you understand your security posture at a given moment in time as well as how it’s changing, for better or worse.

●     Event detail, compliance, and forensics. These provide an understanding of what happened during a security event. They help improve defenses, support breach containment efforts, and aid in legal enforcement actions.

●     Workflow data. You can easily export this data to other solutions to improve incident response management.

●     Real-time device health monitoring. Quickly see the status of your devices either from a consolidated, high-level view or via detailed, customizable status pages (Figure 2).

Contextual network and security information

Real-time Device Health Monitor

Centralized Policy and Operations

●     Maintain consistent policies: Write a policy once and scale enforcement consistently across multiple security controls throughout your network.

●     Reduce complexity: Get unified management and automated threat correlation across tightly integrated security functions, including application firewalling, next-generation Intrusion Prevention, and file and malware protection.

●     Accelerate key security operations functions: Increase efficiency by removing manual processes. Access security patches and new features faster by completing software upgrades in just a few clicks.

Features and benefits

Open APIs for easy integration

FMC makes integration with third-party technologies possible through powerful, feature-rich application programming interfaces. The APIs provide connection points for:

●     Moving event data from FMC to another platform, such as a Security Information and Event Management (SIEM) solution.

●     Enhancing the information contained in the Cisco IPS database with third-party data. Such data might include vulnerability management.

●     Kicking off workflows and remediation steps that are activated by user-defined correlation rules. You could, for example, integrate your workflow with a Network Access Control (NAC) solution to quarantine an infected endpoint or initiate a digital forensic process.

●     Supporting third-party reporting and analytics by enabling those solutions to query the FMC database.

These APIs are also used to integrate with several Cisco security products and workflows. These include Cisco Secure Malware Analytics (formerly Cisco AMP Threat Grid) for sandboxing; the Cisco Identity Services Engine (ISE) for identity data and network segmentation; and Cisco Umbrella^® for internet-wide domain visibility.

The Cisco Secure Technology Alliance is a security ecosystem that facilitates open, multivendor product integrations to improve security effectiveness through automation and operational simplicity. Cisco is actively partnering with 100s of key security vendors and integration with over ten Cisco security products. To see the latest list, visit Cisco Secure Technical Alliance Partners.

Cisco SecureX

Cisco SecureX connects the breadth of Cisco’s integrated security portfolio and your entire security infrastructure for a consistent experience that unifies visibility, enables automation, and strengthens your security across the network, endpoint, cloud, and applications. The result is simplified security, built into the solutions that you already have.

SecureX’s threat response feature (formerly CTR) integrates threat intelligence from Cisco Talos and third-party sources to automatically research Indicators of Compromise (IOCs), also known as observables, and confirm threats quickly.

For Secure Firewall customers, the SecureX ribbon in the Firewall Management Center (FMC) allows an administrator to instantly pivot back and forth for deeper threat investigation, sharing and maintaining context around incidents.

SecureX in the FMC

Find here the prebuilt workflow playbooks that address common use cases for observable actions, remediations, and incident endpoint enrichment.

How does it work?

Cisco firewalls send data to SecureX with a secure intermediary cloud service. SecureX threat response queries for sightings related to the IP address being investigated and provides an analyst with the additional context. Intrusion events are promoted to investigation-worthy incidents in the Incident Manager, based on Cisco Talos reputation or user-defined filters. This allows your team to quickly investigate and triage to see analytics on intrusion events.

SecureX Orchestrator can invoke FMC API calls, which allows administrators to automate routine FMC tasks, improving efficiency. SecureX is available as a standard for customers with Cisco Secure Firewall and/or any Cisco Secure product.

Deployment options

FMC can be deployed as a physical or virtual appliance, or from the cloud. It can also be consumed as a service. The cloud-delivered FMC, through CDO, has all the benefits of FMC without the need to manage FMC software update itself. You can choose which option works best for your environment. Please visit the current Release Notes for more detailed information.

Hypervisor compatibility and cloud support

Firewall Management Center Virtual supports the following hypervisor types shown below. All models of the FMC Virtual platform will operate with the same RAM requirements: 32 GB recommended^**; 28 GB^** required. For current versions supported and compatibility with FMC versions, visit current Release Notes.

Table 1.           Virtual appliance hypervisor and cloud support

Note:       Refer to the Cisco Secure Firewall Management Center Virtual Getting Started Guide for more information.

Platform specifications

There are several Firewall Management Center models. Choose based on the number of sensor appliances to be monitored (both physical and virtual), the number of hosts in your environment, and the anticipated security events rate (see Table 3). All models provide the same management capabilities.

Table 2 compares the capacities of available Cisco Firewall Management Center physical appliances.

Table 2.           Cisco Secure Firewall Management Center hardware models

Table 3 compares the capacities of available Cisco Secure Firewall Management Center virtual appliances.

Table 3.           Cisco Firewall Management Center Virtual (FMCv) models

Cloud-delivered FMC can be scaled for your needs. Please refer to our Release Notes for more detailed information on compatibility, supported versions, deployments, and browser requirements.

Ordering information

For ordering and licensing information on virtual and physical appliances as well as cloud-delivered service, please consult the Cisco Network Security Ordering Guide. To place an order, visit the Cisco Ordering Home Page, contact your Cisco sales representative, or call us at 1 800 553 6387.

Warranty information

Find warranty information at the Cisco.com Product Warranties page.

For more information

●     Cisco Security Management Portfolio

●     Cisco Secure Firewall

●     Cisco Secure Firewall Management Center Release Notes

●     Secure IPS (NGIPS)

●     Malware Defense

●     Cisco Security Analytics and Logging

●     Network Security and Trust for Service Providers

●     Services for Security

●     Cisco Firepower Management Center (Previous Models) Data Sheet