Configuration · Topic 1 of 9
FMC System Settings
Learn the main FMC system settings, including access list, time, HTTPS certificate, users, licences, updates, backup and the REST API for scripts.
- 4 min
- System settings configure the FMC itself, not the managed firewalls.
- The access list limits which addresses can reach the FMC over HTTPS and SSH.
- The HTTPS certificate is the one the FMC web interface presents.
What it is
System settings control the Secure Firewall Management Center (FMC) itself, not the firewalls it manages.
They cover who can log in, how the FMC keeps time, which certificate it presents, how it is licensed and updated, and how it is backed up. A new FMC needs these settings checked before you build any policy.
Menu names move between releases. This page uses the names that appear in the 7.x releases and describes the rest in words.
How it works
Most settings live in a Configuration page under the System menu, and a few have their own pages.
Configuration page
The Configuration page lists many sections. The ones you meet most often are in this table.
| Section | What it controls |
|---|---|
| Access List | Which addresses may reach the FMC over HTTPS and SSH |
| Audit Log | Sending the audit log to a syslog server |
| Email Notification | The mail relay used for reports and alerts |
| HTTPS Certificate | The certificate the FMC web interface presents |
| Login Banner | A message shown before login |
| Management Interfaces | The FMC management IP settings |
| REST API Preferences | Turns the REST API on or off |
| SNMP | Lets a monitoring system poll the FMC |
| Time and Time Synchronization | The time source for the FMC, such as an NTP server |
| Session Timeout | How long an idle session lasts |
The access list is worth care. If you remove your own address from it, you lock yourself out of the web interface.
Time
Correct time matters for events, certificates and licensing. The FMC can take its time from an NTP server, and it can also act as the time source for the devices it manages.
The managed devices usually get their time through a platform settings policy, which is covered with device management.
Users and roles
User accounts are created under System, Users. Each user has a role, such as Administrator or Security Analyst, that limits what the person can see and change.
Users can also be authenticated by an external system such as LDAP or RADIUS. You enable this by adding an external authentication object, so that passwords are held elsewhere.
Licences
The FMC uses Smart Licensing for the devices it manages. The FMC registers with the Cisco Smart Licensing cloud, and each managed device takes the licences it needs.
The common licence types cover base features, intrusion prevention, malware defence and URL filtering. Names have changed between releases, so check the current names on the licence page.
Updates, backup and the REST API
The Updates page loads software updates, as well as rule and database updates. These include intrusion rules, the vulnerability database and geolocation data.
Backup and restore are among the System tools. Take a backup before an upgrade or a big change.
The REST API lets scripts talk to the FMC. It must be allowed in the REST API Preferences and the account used needs the right role.
Deploying changes
Changes to policies and device settings are not live until you deploy them. System settings of the FMC itself take effect on that appliance when you save them, and do not go through the deploy step.
What to remember for the exam
Seven facts cover the usual questions.
- System settings configure the FMC itself, not the managed firewalls.
- The access list limits which addresses can reach the FMC over HTTPS and SSH.
- The HTTPS certificate is the one the FMC web interface presents.
- Time can come from NTP and matters for events and certificates.
- Users have roles, and external authentication uses LDAP or RADIUS.
- Smart Licensing connects the FMC to the Cisco licensing cloud.
- The REST API is switched on in the REST API Preferences.
When a question asks how to stop an address reaching the FMC web interface, think of the Access List setting, not an access control policy.
Common mistakes
These four mistakes are common with FMC settings.
Confusing FMC settings with platform settings. System settings are for the FMC, and platform settings policies are for managed devices.
Locking yourself out. Removing your own address from the access list stops your access.
Skipping the backup. A backup before an upgrade gives you a way back.
Leaving the clock wrong. Bad time causes confusing event times and certificate errors.
An external authentication object that is wrong can stop users logging in. Keep a local administrator account for recovery.
Check yourself
Work through these three questions.
Which setting controls the addresses that can reach the FMC web interface?
The Access List, which limits who can use HTTPS and SSH to the FMC.
What do you turn on to let scripts use the FMC?
The REST API in the REST API Preferences, and the account needs a suitable role.
Why take a backup before an upgrade?
It gives you a way to restore the FMC if the change goes wrong.
Topic 1 of 9 in Configuration
Test yourself on Configuration
The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.