Integrations
Every system Connect talks to is set up as an account under Integrations: your cloud subscriptions, your on-prem enforcement points, and the IT systems you export to. This page lists all of them, says which ones need the on-prem Connector, and covers the setup steps they share. Each integration then has its own page.
Which integrations need the Connector
Connect reaches most systems directly from the cloud. The Connector comes in when the target sits inside your network, reachable only from within it. The table below says which integrations need one.
| Integration | What it does | Connector | Setup |
|---|---|---|---|
| Amazon Web Services | Discovers resources into Inventory; forwards CloudTrail and Security Hub events | Not needed | AWS |
| Microsoft Azure | Discovers resources into Inventory; exports Connect Groups as Azure IP Groups | Not needed | Azure |
| Illumio | Discovers workloads into Inventory | Not needed | Illumio |
| SentinelOne | Discovers assets into Inventory | Not needed | SentinelOne |
| Guardicore | Discovers assets into Inventory; exports approved change requests as segmentation rules | Not needed | Guardicore |
| ServiceNow | Discovers CMDB records into Inventory; exports change requests and decommissioned assets | Not needed | ServiceNow |
| FireMon Security Manager | Discovers network objects and zones into Inventory | Not needed (uses your Insights registration) | Security Manager |
| FireMon Asset Manager | Receives the assets Asset Manager pushes into Inventory | Not needed (Asset Manager connects to Connect) | Asset Manager |
| Infoblox | Discovers networks into Inventory | Optional: select a Connector when your Grid Manager is reachable only from inside your network | Infoblox |
| Palo Alto Networks (Panorama) | Exports Connect Groups as Dynamic Address Groups | Required | Panorama |
| VMware NSX | Exports Connect Groups as NSX Groups | Required | NSX |
| Cisco Firewall Management Center | Exports Connect Groups as FMC dynamic objects | Required | Cisco FMC |
| Fortinet FortiManager | Exports Connect Groups as FortiManager address groups | Required | FortiManager |
The five Connector-based integrations are documented under Connector > Integrations, which also explains how to watch their jobs.
One more kind of account works differently. A Test account holds inventory uploaded from a CSV file. Create one from Import Inventory CSV on the Integrations page, which appears when the feature is enabled for your organization. Test accounts then appear on their own row on the Integrations page.
Two kinds of work
- Inventory discovery reads assets from a system and brings them into Inventory, where they sit alongside your cloud resources. You can search and filter them, and build Groups from them. Discovery reads the source system and writes only to Inventory. Asset Manager is the one exception: it pushes its assets into Inventory rather than being read.
- Export pushes something out of Connect: a Group's IP addresses to an enforcement point (Azure, Panorama, NSX, FMC), an evaluated change request to a policy or ticketing system (Guardicore, ServiceNow), or a decommission match to a CMDB (ServiceNow).
An account can do both. ServiceNow and Guardicore accounts have Import and Export checkboxes on their Provision page. They control which fields the page shows, and both are checked each time it opens. Clearing Import on a ServiceNow account leaves out the Import Settings, so no discovery runs. A Guardicore account uses one set of credentials for both, so it discovers and exports once provisioned.
Common to every integration
- Setup runs across two pages. Integrations > New Integration Account opens New Account, which takes the account's identity: the Provider, the system's own identifier where it has one (AWS Account ID, Azure Subscription ID, and so on, for AWS, Azure and Illumio), a Name, a Project, and a Connect Access level. Under Optional, Environment labels the account Production, Staging, Development, or Testing/QA, which Inventory filters and Group criteria can both select on. Continue to Provisioning saves the account and opens the Provision page, where the credentials go; Provision Account there finishes setup. A Setup card on both pages shows which of the two steps you're on.
- Provider, identifier, project, and access level are fixed once the account exists. The account's edit page shows them greyed out, since changing one would mean provisioning again. Name, Environment, Labels, and Attribute Shortcuts stay editable there, and everything on the Provision page stays editable too. To change a fixed field, create a second account and delete the first.
- Test the connection from the Provision page. Saving validates the form; Test validates the connection. It signs in with the stored credentials and reports what happened in four steps: DNS lookup, TCP connection, TLS certificate, and Sign-in and read, so a failure names the layer that broke. Save first, and the button enables. Cisco FMC, Guardicore, Illumio, Infoblox, NSX, Panorama, SentinelOne, and ServiceNow accounts offer it; AWS, Azure, and Security Manager are verified from their own pages instead. See Watching for problems.
- Passwords and tokens are write-only. Every password, secret, and API token field is stored encrypted, so it opens blank each time you return to the Provision page. Leave it blank to keep the saved value, or type a new one to replace it. It is only required the first time the account is provisioned.
- Discovery runs on its own. The first discovery starts automatically as soon as an account is provisioned, and every account is re-discovered daily after that. Items dropped from the source are removed by the next run. Connect holds removals back when a run returns nothing or far fewer items than the account held, and keeps items of any type that hit an error in that run, rather than risk deleting what is still there.
- Least-privilege credentials. Each integration's page says what its account must be able to do. Discovery needs read access only; exports need write access to exactly the objects Connect creates.
Where to find what was discovered
| Where | What you see |
|---|---|
| Integrations (main navigation) | One row per provider: how many accounts it has, a Status column flagging any that need attention, and how many Assets it has contributed (click through to those items) |
| Integrations, with a provider's row expanded | One row per account: its Status, whether it runs On-Prem or from the Cloud, its project, environment, and labels, and buttons to edit, delete, or open Provision. The search box above matches provider, account, project, and environment |
| Inventory > Resources, filtered by Vendor | The individual items, with the integration shown in the Integration column |
| Groups > Group Candidates | The same items, matched by your Group's criteria, so you can export them to Azure, Panorama, NSX, or Cisco FMC |
Watching for problems
Discovery problems surface in two places:
- Integrations shows a warning badge (for example, "1 account requires attention") on the affected provider's row. It counts accounts with discovery errors and accounts whose last Connector job failed. Expand the row to see which account, and open its Provision page from there.
- The account's Provision page shows a Resource Errors alert. Expand Error Details for the region, resource type, error message, and time of each failure. If the errors are about permissions, re-check the credentials; otherwise the alert asks you to contact FireMon Support with the error details.
Errors clear on their own once a later discovery reads the same region without hitting them. To find out whether the credentials are the problem without waiting for the next run, press Test on the Provision page.
Export problems are reported where the export was configured: the History tab under Decommission for decommissioned-asset exports, and on the target system itself for change request and Group exports. See Troubleshooting.