Asset Manager
The Asset Manager integration brings the devices FireMon Asset Manager has discovered on your network into Connect's Inventory, one item per asset, carrying the IP addresses, hostname, MAC address, and tags Asset Manager reports for it. Connect does not read from Asset Manager, as it does from its other integrations. Asset Manager pushes its assets into a Connect account through Connect's API. When it pushes, and which zones it includes, are set in Asset Manager.
Connect holds what Asset Manager sends. Nothing is created, changed, or deleted in Asset Manager.
Before you start
| Prerequisite | Why it's needed | Where to check |
|---|---|---|
| A Connect user for Asset Manager to sign in as, with the Administrators role | Asset Manager signs in as this user, and adding items to an account takes the same permission as managing accounts, which the Administrators role has. A dedicated user keeps the integration separate from any one person's login | Settings > Users. See Users and Roles |
| Groups enabled for your organization | Connect refuses the push when they aren't | The Groups page says so if they aren't; contact FireMon Support |
| Outbound HTTPS from Asset Manager to FireMon Cloud | Asset Manager opens the connection to Connect; Connect never connects to Asset Manager | Asset Manager's integration pages list the addresses to allow through your firewall |
| An Asset Manager release with the Connect integration | The push is a feature of recent releases | The Asset Manager release notes for 5.4 and 5.5 describe the push |
Set up an Asset Manager account
- In Connect, go to Integrations and click New Integration Account.
- Provider: Asset Manager. Give it a name and a project. The name is the label shown throughout Connect, so use something you and your team will recognize. There is no account ID to enter, and Connect Access can stay at its default, since Connect never writes to Asset Manager.
- Click Continue to Provisioning. The Provision page opens with nothing to fill in: the credentials live in Asset Manager, not in Connect. The account is ready to receive assets as soon as it exists.
- In Asset Manager, set up the Connect integration under Settings > Integrations. It signs in to Connect as the user you set aside for it, and its assets land in the account you just created. Which zones to push is set there too. The fields are described in the Asset Manager User and Administrator Guide for your release.
- After the first push, check that it landed as described below.
What gets pushed
Each asset becomes one inventory item of type Asset, sourced from Asset Manager:
| Asset Manager sends | Where it lands |
|---|---|
| The asset's ID | The item's ID. Items are matched by it within the account, so a push updates the item in place |
| Name and hostname | The item's name and hostname |
| IP addresses | The item's IP addresses |
| MAC address | The item's MAC address |
| Tags | The item's tags. A value longer than 256 characters is cut and marked as truncated |
| The device's attributes | The item's raw attributes, on the Attributes tab. Use them in an Attributes criterion, or save the paths your team relies on as Attribute shortcuts |
| When the device was last seen, and when a firewall rule last matched it, where Asset Manager reports them | Last Seen and Last Rule Hit on the item |
Each item's Integration is Asset Manager. Its Source is the Asset Manager data source that found the asset, such as Infoblox, when Asset Manager reports one. Items show a Location of global unless Asset Manager sends a region.
Verify it landed
| What to check | Where to look |
|---|---|
| The push arrived | Integrations in the main navigation: the Asset Manager row's Assets count matches what Asset Manager pushed |
| The items themselves | Inventory > Resources, filtered by Vendor > Asset Manager. You should see items of type Asset. Open one: its IPs, hostname, and tags should match the device in Asset Manager |
| When it last arrived | The Last retrieved from Asset Manager line under an item's details is the time of the last push that included it |
Once they're in inventory, assets can be selected into a Group by tag, by CIDR, or by an Attributes criterion against the device record, and exported to Azure, Panorama, NSX, Cisco FMC, or FortiManager.
Details and edge cases
Connect never re-reads. There is no daily discovery for this account and no Test button. Connect holds what Asset Manager last sent, so an item with old IPs or tags means the push hasn't run since they changed, not that Connect dropped anything. An asset that Asset Manager stops reporting is not removed by Connect on its own. Items stay until Asset Manager deletes them, or until you delete the account, which removes all of its items.
Problems show in Asset Manager, not in Connect. Since nothing runs on the Connect side, the account never shows Resource Errors, and the warning badge on Integrations never flags it. If assets stop arriving, check the integration's status in Asset Manager. The usual causes are a sign-in failure, because the Connect user's password changed or the user was disabled or lost the Administrators role, and Groups being disabled for your organization.
The account shows Not provisioned. Provisioning is where Connect stores credentials for the systems it reads, and this account has none. The tag is expected for this provider and doesn't hold up the push.
Groups update as soon as an asset lands. Automatic Groups add or drop it at once, and Manual Groups record it as a pending change.
A large push takes a few minutes to land. The Assets count on Integrations settles once it has.
For common issues, see Troubleshooting.
Asset Manager documentation
- Asset Manager User and Administrator Guide: configuring integrations under Settings > Integrations, including the addresses to allow through your firewall
- Asset Manager 5.5 release notes: pushing assets to Connect by zone
- Asset Manager 5.4 release notes: adding the IPs Asset Manager discovers from Infoblox to Connect