Security Manager
The Security Manager integration brings objects from your on-prem FireMon Security Manager into Connect's Inventory, where they sit alongside your cloud resources:
- Network Objects: the address objects defined on each device (hosts, groups, subnets, ranges), with their addresses and, where Security Manager has them, hit counts and last-used times
- Zones: each device's security zones, with the IP addresses of the interfaces in the zone
It authenticates through the connection your Security Manager already holds open to FireMon Insights. This integration only reads from Security Manager.
Before you start
| Prerequisite | Why it's needed | Where to check |
|---|---|---|
| Security Manager registered with FireMon Insights | Connect reaches Security Manager only through the Insights connection | In Security Manager, Administration > Settings > Insights shows Registration Details when registered. See Connect Your SIP Instance |
Outbound HTTPS from the Security Manager application server to insights.prod.firemon.cloud and ws.insights.prod.firemon.cloud | Registration uses the first; discovery runs over the persistent connection to the second | Insights prerequisites |
| The Security Manager provider enabled for your organization | It's hidden in the Provider list by default | Ask FireMon Support to enable it |
One Connect organization can hold one Security Manager registration. If you run several independent Security Manager installations, each needs its own Connect organization.
Set up a Security Manager account
- In Connect, go to Integrations and click New Integration Account.
- Provider: Security Manager. Give it a name and a project. The name is the label shown throughout Connect, so use something you and your team will recognize.
- Click Continue to Provisioning. The Provision page opens with its configuration already complete, because Security Manager authenticates through the Insights registration. The account is provisioned as soon as it is created, and the first discovery starts on its own.
You can create the account before registering with Insights, but discovery fails until the registration exists. Register with Insights first to avoid a failed run.
What gets discovered
Discovery walks every device in Security Manager's default domain and creates:
| Item type | One per | Name | IPs |
|---|---|---|---|
| Network Object | network object on a device | The object's display name | The object's addresses, flattened |
| Zone | zone on a device | The zone's display name | The primary and secondary addresses of every interface in the zone |
Items are identified by device ID and object name, so renaming an object in Security Manager shows up as a new item on the next run, and the old one is removed. The first run on a large installation can take an hour or more.
Verify it landed
| What to check | Where to look |
|---|---|
| The account is healthy | Integrations: the Security Manager row's Status stays clear, and the account's Provision page shows a Provisioned tag |
| The item count | Integrations in the main navigation: the Security Manager row shows an Assets count |
| The items themselves | Inventory > Resources, filtered by Vendor > Security Manager. You should see items of type Network Object and Zone, with totals roughly matching Security Manager |
Once they're in inventory, network objects and zones can be selected into a Group like any other item, for example every zone on a device, or every network object whose name matches a pattern, and exported to Azure, Panorama, NSX, Cisco FMC, or FortiManager.
Details and edge cases
Discovery covers the default domain. Devices in other Security Manager domains are out of scope today.
Clustered Security Manager needs FireMon Support. Each application server runs the Insights plugin and holds its own connection. Insights accepts the first server that connects and refuses the others until FireMon Support allows their hostnames. After that, one Connect account covers the whole cluster.
Moving Security Manager to a new server makes Insights reject the new host's connection, as a safeguard against restored backups. Ask FireMon Support to allow the new hostname; discovery resumes on its own once it's allowed.
For common issues, see Troubleshooting.
Insights documentation
- Connect Your SIP Instance: registering Security Manager with Insights, and what registration does
- Insights prerequisites: versions, firewall rules, and licensing for the registration
- Insights troubleshooting: when the registration itself is the problem