Configuration · Topic 6 of 9
Device Management, Certificates and Health
Learn how to add and manage devices in the FMC, enrol certificates, build platform settings policies and use health policies and the health monitor.
- 4 min
- A device is added with its address, name, registration key and an access control policy.
- A certificate enrolment object defines how a certificate is obtained.
- Enrolment types include self signed, manual, PKCS12 and SCEP.
What it is
Device management is the work of adding firewalls to the Secure Firewall Management Center (FMC) and setting them up.
It includes registering the device, giving it interfaces, enrolling certificates, applying a platform settings policy for device wide services, and watching its health with a health policy.
This page covers the device side, and later pages cover NAT, routing and VPN, which are also device settings.
How it works
Most tasks start on the Device Management page, and policies are then assigned to devices.
Adding a device
You add a device by giving its address, a display name, the registration key and the initial access control policy. You also choose the licences the device should use.
After registration, the device shows a page with tabs for the device itself, routing, interfaces, inline sets, DHCP and more. Groups let you organise many devices and apply changes to a set.
Certificates
Certificates are used for VPN, for decrypting traffic and for other features. The FMC enrols them on a device in two parts.
First you create a certificate enrolment object in Object Management. Its type can be a self signed certificate, a manual enrolment that uses a certificate signing request, a PKCS12 file import, or SCEP. Then you add the certificate to the device and select that enrolment.
| Enrolment type | Use |
|---|---|
| Self signed | Quick and for tests |
| Manual | You create a request and import the signed reply |
| PKCS12 file | You import a certificate and key together |
| SCEP | The device asks a certificate authority automatically |
A trusted CA certificate has to be on the device before it can validate certificates from that CA.
Platform settings
A platform settings policy holds services that apply to the whole device. You build the policy and assign it to devices.
| Section | Examples of what it sets |
|---|---|
| Banner | Login banners |
| DNS | DNS servers for the device itself |
| SSH Access | Which hosts may open SSH to the device |
| HTTP Access | Which hosts may open the device web service |
| Syslog | Where the device sends syslog |
| SNMP | SNMP settings |
| Time Synchronization | NTP servers |
| Time Zone | The device time zone |
| Timeouts | Idle timers such as for connections |
| External Authentication | Login through an external server |
Platform settings are different from the FMC system settings. Platform settings affect the managed device, and system settings affect the FMC.
Health policy and monitor
A health policy lists health modules, which are checks such as CPU, memory, disk, interfaces, hardware and smart licence status. Each module has thresholds for a warning and for a critical state.
You apply the policy to a device. The health monitor then shows each device as normal, warning or critical, with the module that caused it. Alerts can be sent by email, SNMP or syslog when a state changes.
Deploying
Interface changes and platform settings reach the device after a deploy. Health policies are applied from the health area and do not depend on the policy deploy.
What to remember for the exam
Seven facts cover the usual questions.
- A device is added with its address, name, registration key and an access control policy.
- A certificate enrolment object defines how a certificate is obtained.
- Enrolment types include self signed, manual, PKCS12 and SCEP.
- Platform settings apply device wide services such as SSH access, syslog and time.
- FMC system settings do not replace platform settings.
- A health policy has modules with warning and critical thresholds.
- The health monitor shows device status and can raise alerts.
If a question asks how to limit which hosts may open SSH to a managed firewall, think of SSH Access in a platform settings policy.
Common mistakes
These four mistakes are common here.
Mixing up system settings and platform settings. One is for the FMC and the other is for managed devices.
Forgetting the CA certificate. Without the trusted authority, the device cannot validate a certificate from it.
Choosing self signed for production VPN. Clients then see warnings or need to trust it by hand.
Ignoring health alerts. A warning left alone can become a failure.
A manual enrolment is not finished until you import the signed certificate. The enrolment stays pending until then.
Check yourself
Work through these three questions.
What is the difference between system settings and platform settings?
System settings configure the FMC itself, and platform settings configure services on managed devices.
Which two certificate enrolment types does the FMC offer, besides PKCS12 and SCEP?
Self signed and manual, where manual uses a certificate signing request.
What does a health policy contain?
It contains health modules with warning and critical thresholds, which the health monitor uses to show device status.
Topic 6 of 9 in Configuration
Test yourself on Configuration
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.