Configuration and Management of Cisco Firepower Management Center
Domain 2 covers FMC as a management platform: how objects, policies, users, and deployment tasks are organized, and how changes are approved, audited, and pushed. The exam favors role questions, object reuse, policy assignment, and deployment-failure diagnosis.
Objects and reuse
- Network, port, URL, geolocation, application filter, time range, security zone, variable set, file list, DNS group, and SGT objects are the reusable building blocks.
- Most objects are global; network and port objects support per-device overrides so one object can carry different values on different appliances.
- Editing an object changes every policy that references it; deleting an object still in use is refused until references are removed.
Policy hierarchy
- An access control policy (ACP) holds ordered rules, a default action, and linked identity and SSL policies; each rule may reference its own intrusion (network analysis) policy and file policy.
- Policies are assigned per device or device group under Device > Device Management. Device groups let one policy serve many appliances; a device can carry only one ACP.
- A prefilter policy sits ahead of the ACP for tunnel and fastpath rules.
Users, workflow, audit
- Predefined roles include Administrator, Access Admin, Network Admin, Intrusion Admin, Security Analyst (and read-only), Security Approver, and Maintenance User. Authentication can be local, LDAP/AD, RADIUS, TACACS+, or SAML.
- With change management enabled, edits are submitted and approved, and the approver must be a different user. The audit log records user, timestamp, and a before/after diff.
Health and backup
- Health Monitor applies a health policy per device and alerts on CPU, disk, interface, and Snort status. Those alerts are not deploy errors - deployment results live in Task Status and Message Center.
- Backup from the FMC GUI can target local storage or a remote SSH/SFTP host; restore is to the same FMC version and model family.
Worked example
A new /24 must appear in three policies. Create one network object or group, reference it in the three rules, save, then Deploy to the target devices and inspect the task. If deployment fails, the Task Status message names the cause - typically a rule referencing an interface or zone that does not exist on a target device.
Traps
- Editing a shared object and assuming only one policy changes.
- Treating a green health status as proof the last deployment succeeded.
- Expecting an administrator to approve their own submitted change.