Management and Troubleshooting · Topic 6 of 6

Device Management Tools Compared

Compare the tools that manage Secure Firewall, Security Cloud Control firewall management, Secure Firewall Device Manager and the Management Center.

  • 4 min
  • Includes a diagram
In a nutshell
  • The FMC manages many devices and has the full feature set.
  • FDM is local to one device and has a simpler feature set.
  • Cloud management is hosted by Cisco and manages many devices.

What it is

Secure Firewall Threat Defense can be managed with three tools, and each fits a different size and style of network.

The Secure Firewall Management Center (FMC) is the full featured manager for many devices. The Secure Firewall Device Manager (FDM) is a simple local interface on one device.

Cisco Security Cloud Control Firewall Management is the cloud service that provides a Cisco hosted management centre. It was formerly called the cloud-delivered Firewall Management Center.

A device uses one of them at a time.

FDMone device, localone manager at a timeFMCmany devices, you run itorCloud managementmany devices, Cisco runs it

How it works

The tools differ in where they run, how many devices they manage and how rich their features are.

Secure Firewall Management Center

The FMC runs on a hardware appliance or as a virtual machine that you operate. It manages many devices, and policies are shared between them.

It has the full set of features: events and reporting, discovery, correlation and integrations. Most of the policy pages in this guide are FMC pages.

Secure Firewall Device Manager

FDM runs on the device itself and you open it in a web browser. It is made for a single firewall, and it has a simpler set of settings and a guided first setup.

It suits small sites with one device and no need for central policy. It has fewer features than the FMC and a smaller event view.

Cloud management

Cisco Security Cloud Control offers a firewall management service that is hosted by Cisco. You do not run or patch the management centre. You onboard devices to it and manage them from a web interface.

It follows the model of the FMC, with shared policy for many devices. It can also be used with other tools in the same cloud portal. The service name changed over time, so you may see the older name cloud-delivered FMC in documents.

Choosing

Three ways to manage Threat Defense: an on premises FMC managing several devices, Cisco-hosted Security Cloud Control managing onboarded devices, and FDM running on a single device.

PointFDMFMCCloud management
DevicesOneManyMany
Runs whereOn the deviceOn premises, hardware or virtualHosted by Cisco
OperationLocalYou run and upgrade itCisco runs it
Feature depthBasicFullFollows the FMC model
Best forA single small siteA large or detailed deploymentTeams that prefer a cloud service

Switching between managers

A device is managed by one manager. To move a device from FDM to an FMC, you register it with configure manager add. To go back to local management, you use a command on the device.

> configure manager add 192.0.2.10 MYKEY
> configure manager local
> show managers

Moving to a new manager changes where policy comes from. Plan it, because policy built in one tool does not simply carry over to another.

FDM managedlocal policyconfigure manager addFMC managedcentral policyconfigure manager localFDM managedlocal again

Troubleshooting links

Whichever tool you use, the device CLI stays the same. The commands from the earlier pages, such as show managers and show failover, help in all three cases.

For cloud management, a device must be able to reach the cloud service. If a device cannot reach it, check routing, DNS and any filtering on the path.

What to remember for the exam

Seven facts cover the usual questions.

  • The FMC manages many devices and has the full feature set.
  • FDM is local to one device and has a simpler feature set.
  • Cloud management is hosted by Cisco and manages many devices.
  • Cloud management was formerly called cloud-delivered Firewall Management Center.
  • A device has one manager at a time.
  • configure manager add moves a device to an FMC.
  • configure manager local returns a device to local management.
Exam tip

When a question describes a single small site with no need for central management, think of FDM.

Common mistakes

These four mistakes are common when choosing a tool.

Using FDM for a large estate. It manages one device, so shared policy is not possible.

Thinking the cloud service needs no connectivity. Devices must reach it.

Expecting policy to move automatically between tools. You plan and rebuild or migrate it.

Forgetting the old name. Older notes call the cloud service cloud-delivered FMC.

Watch out

Changing the manager of a device changes where its policy comes from. Back up and plan the change before you do it.

Check yourself

Work through these three questions.

  • Which tool manages a single device through a local web page?

    Secure Firewall Device Manager, FDM.

  • What was Cisco Security Cloud Control Firewall Management called before?

    It was called the cloud-delivered Firewall Management Center.

  • Which command returns a device to local management?

    configure manager local.

Topic 6 of 6 in Management and Troubleshooting

Test yourself on Management and Troubleshooting

The full Cisco CCNP 300-710 SNCF question bank has 865 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.