What is our primary use case?
We use the Security Manager module. We use it to report and audit firewall changes. We also use it to track the hygiene of our firewalls in addition to the changes made to them. Since it normalizes the firewall config, we are able to do custom searches and make custom controls to build out those audits and reports, making sure that we are applying firewall rules correctly. There are a lot of built-in reports as well, which help us to identify rules and objects that are being used.
We are an enterprise environment. We are definitely not the largest of FireMon's customers, deployment-wise.
How has it helped my organization?
FireMon automatically warns us when new firewall rules, and changes to existing ones, violate compliance policies before they are deployed. We find this valuable as well, especially from the compliance standards where it has real-time change detection and FireMon watches the firewalls. Whenever there is a change that breaks compliance, we get that immediately. At the same time, whenever you are planning a change inside FireMon, it won't let you make that change when there is a compliance issue that they found.
We have built-in change reporting in Security Manager, which is very helpful. Whenever we have a scheduled change report, we use that as an opportunity to review the report and do a technical review of the changes that were made.
It does a search whenever you are planning a rule in FireMon. So, if the traffic that you are trying to create a rule for is already allowed, FireMon will tell you. This will save you the time of trying to create a duplicate rule if you already have a rule that would allow the traffic.
What is most valuable?
The change normalization is the most valuable feature. It gives us the ability to just do a search based on time, device, or even device groups. It just shows us one by one what the changes to the config were and what time they were. It even shows which admins made the changes. The individual changes can be searched. You can create reports of the changes. That is probably the most valuable feature that we have.
Cleanup of rules is a huge pro of FireMon. After a change detection, the firewall hygiene is our number two most important feature that we use FireMon for. Right out the gate, they have built-in features and reports that will allow you to go through your firewall and identify objects that are not used in config. They have a report that is called removable rules, which is extremely helpful and very powerful. It goes through your firewall and identifies rules that are unlikely to be hit, either because the rules are set up wrong for your routing or they are completely shadowed, meaning that the rule will never have any impact on traffic going through the firewall. Those are both very powerful built-in reports that we do use extensively.
The firewall config is normalized in FireMon to do custom searches, so you can search off of any number of things. You can search off of rule names. You can search off of the different addresses that would be inside that rule. You can also search based off of services that are allowed or disallowed by the rule. Therefore, it lets you search any number of firewall types in the same search syntax. You could have an ASA and Juniper, then in FireMon, you can do a search that will return rules from both devices. So, it is very powerful.
We can create custom controls based on the hygiene. Whenever we have rules that are tagged as temporary, we have custom hygiene controls that will go through and help us make sure those are cleaned up after we are done using them.
The quality of our reports has improved drastically. These are reports that we can use internally from a technical standpoint, we can send up to our own management, or we can even use some of them externally for different auditors or other requirements that we have.
In most firewalls that you use, you have a comment field where you can put a change request ID and a little information about the rule. FireMon scales that up to 10. Within FireMon rules, you have fields for ticket ID. You have fields for the rule owner: the admin who created the rule, the security guy who approved the rule, and the business request, e.g., someone from IP systems or if it is a developer. Therefore, it has very verbose rule documentation inside of FireMon. Those are all searchable as well.
What needs improvement?
While I like the reporting, I think that has the biggest room for improvement. Right now, as a user of FireMon, if I create a report, I am the only one who can see it inside FireMon. If someone on my team creates a report, they are the only person who can see that report on FireMon. It doesn't matter if you're admin in FireMon or not. The way we have to do it now is that we have created a service account user and that service account user runs all the reports. This way, all the reports, which are running, are just run under a single user so we can always access them. This definitely needs to change so users can see other users' reports or we can share reports within FireMon.
FireMon could improve their support for individual vendors. There are features that are specific to Cisco Firewalls that are not supported in FireMon. That changes a lot because they do release updates pretty regularly. However, if you are using Check Point, and that is what you use as your firewall, and you don't use Cisco Firewalls, then all the features for Cisco just aren't really worth it to you. So, FireMon could improve by making sure that they have full coverage for all the vendor specific uses.
Buyer's Guide
FireMon Security Manager
November 2024
Learn what your peers think about FireMon Security Manager. Get advice and tips from experienced pros sharing their opinions. Updated: November 2024.
816,660 professionals have used our research since 2012.
For how long have I used the solution?
We have been using FireMon for about a year.
What do I think about the stability of the solution?
The stability is favorable. We have been running it for a year. We have been able to restore from a backup. We did that as an exercise and that process was very straightforward.
They have built-in monitoring that sends out alerts whenever the CPU or disc usage triggers the thresholds, which are set at intelligent levels.
I have heard from the people at FireMon: When going from version 8 to version 9, that upgrade path was a little bit dicey in terms of stability. Since we installed version 9, I feel like we have been pretty good this whole time on stability.
What do I think about the scalability of the solution?
I have good things to say about scalability. They do have multiple ways of deploying it. If you are a very small company, you can have everything FireMon on one appliance, which is kind of cool. As you need to scale, you can add resources to the database and application servers. You can also add data collectors throughout your environment, which is the biggest thing. The data collectors are machines that retrieve the firewall configuration and receive firewalls usage logs.
Scalability is good. The appliances themselves are massive. We're not the largest of FireMon's customers, but as we grow, the amount of compute resources just in general that FireMon is going to be using will be huge as we grow. So, it is scalable. The architecture makes it scalable, but they are beefy, i.e., In terms of compute resources that these appliances use, just the specs on them.
We do have plans to increase usage, if pricing and resources permit. Right now, we have all our firewalls reporting in FireMon. We also have our network topology loaded in FireMon.
How are customer service and support?
We have worked with them a good deal. I would give them a solid 9 out of 10. The way that they can do a 10 is just by continuing to do what they do. This year has been pretty good, and we have had several dozen cases open with them. Each one of them has been pretty good. There were a couple that could have been resolved maybe a little faster.
Their management and all the techs with whom we have worked have been very helpful. We did have a couple of calls with their team lead.
Their support is US time zone-based. So, they have people who work well with the people at my company. Their support is native English speakers, so they are very easy to understand.
On the whole, their technical knowledge is pretty good. The documentation is a little bit spotty. Sometimes documentation around a specific issue is not full, but the people on a call are able to explain what is going on, what specific logs are, or what could be causing a specific issue. Therefore, the knowledge of their technical people is high.
They are open to video conferencing. So, if you want to manage your entire case through email or through a written format, you can do that. However, a lot of times it is faster just to do a screen-sharing and do a phone call to explain your issue. They have been open to doing that.
The way to move from 9 to 10: They will point you to their professional services, if they feel like your request is outside the scope of their support. They are a little quick to do that sometimes.
Which solution did I use previously and why did I switch?
FireMon identifies risks in our environment and helps to prioritize fixes. This has been a good usage. When we first got FireMon, we built out several custom reports, as well as the built-in reports, which have helped us tighten our security rules. FireMon has helped us improve 2000 rules in the span of three months. These were rules that presented a risk to our organization before we had the project with FireMon to fix those rules.
We are spending about the same amount of time creating new reports as we did with our old reporting processes. However, the new compliance reports that we are turning out are across the board better, e.g., we are getting full change histories. We are getting when you have a control that does not allow a risky service out to the Internet. For example, it automatically goes through the rule base and then distills that report for you, rather than cherry-picking like we did on our old processes. These reports are more accurate and much better.
We used a competing vendor before we bought FireMon. During our purchase phase, when we were looking to replace that vendor, we also did evaluations of two other alternatives as well.
The primary reason that we switched to FireMon from our previous firewall administration platform was that there were bugs in it specific to the firewalls that we were using. This made things, like change detection and their version of compliance controls, unworkable so there was inaccurate reporting.
The secondary reason that we switched to FireMon was the previous solution's support. The support of the people, whom we were using before FireMon, was absolutely terrible.
How was the initial setup?
It took two weeks before we were completely deployed. The actual project took three months, but most of that was knowledge transfer and advanced concepts.
Because FireMon is pretty expensive, our initial purchase was only one module of FireMon, which was Security Manager. We do have licenses for all our firewalls, but we only had the one module, Security Manager, and not the other ones, like Policy Planner and Policy Optimizer. That was our initial implementation setup.
What about the implementation team?
When we purchased FireMon, bundled in our purchase was professional services. So, we got to work with them during the initial implementation, and it was very straightforward and simple to set up. The people who we worked with were knowledgeable and helpful. They shot us the documentation well in advance so we could follow along with that step by step.
What was our ROI?
We have absolutely seen ROI. We are not tying ROI to automation, time saved, nor reduced headcount. Our return on investment has been primarily in the projects that we are able to accomplish with FireMon. For example, last quarter, our team completed 23 projects with FireMon, and they were each tied to a future-oriented process. For all the projects that my team accomplished, we created FireMon controls and reports as well as a cleanup on the firewalls. We also created automation around the FireMon API so these processes and reports are happening automatically in terms of scheduled reporting and automatic ticket requests into our ticket management system. FireMon's return on investment is due to the massive improvements that we have made on firewall management and firewall hygiene.
FireMon decreases errors and misconfigurations by 10% that increase risk in our environment. That has to do a lot with the change reporting that is in place, but also with the built-in controls and custom controls that we have made. Those all decrease the errors that people naturally make on a day-to-day basis for firewall administration.
On an average day, we receive a lot of requests to approve firewall changes, changes to the firewall, and additions to rules. On any given day, we have a request that was not given to us well, e.g., where they have different IPs that are needed or they don't give the right service request. Whenever FireMon gives us a report, we are able to go back through it and correct those changes to make them more accurate.
Whenever we are getting a request where the traffic could hit multiple firewalls, FireMon fact checks us to make sure we are putting the rule in the correct firewall.
What's my experience with pricing, setup cost, and licensing?
FireMon is very expensive. I think that they charge a premium. In general, they are very pricey. Compared to their competitors, they cost a little more than the other solutions that we evaluated.
They license per module. They have four main modules that they license currently. The base license is included with the Security Manager module, which was our initial purchase back a year ago.
The professional services is an add-on, and it is one where you can purchase more professional services. It is per project. So, it is an add-on for your initial implementation project. At a later time, if you have another project that you would want professional services on, they will quote you for that.
The support comes in tiers and it's also per module. I don't know of anyone who would purchase a license for a module and not purchase the support that comes with it.
Which other solutions did I evaluate?
We evaluated both Tufin and AlgoSec, as competitors of FireMon. FireMon differentiated itself because it was more fully featured on the firewalls that we were deploying.
What other advice do I have?
My primary advice is take advantage of professional services whenever you are doing the initial implementation. The second piece of advice is just to adopt the tool. We could have purchased FireMon, set it up, and not done anything with it. Then, we would not have gotten our return on investment. By choosing to adopt the tool and creating projects and processes around it, we have our money's worth out of the tool.
If rule hygiene and policy management are a priority, you just have to make the time for it, in terms of setting aside time during the day that you are able to implement proactive changes and being able to measure those times for management. Anyone who does say that it's a priority for them knows that good policy management pays off in the end. Because down the road, you will be spending less time with a cleaner rule base.
We do not currently use it for automatic rule deployments, but that is a feature that is available and we have tested it. From my perspective, that is a feature which provides value.
We don't automatically deploy rules with FireMon, but I do know that is a feature and we have tested it.
We don't use FireMon to automatically make changes on our firewalls.
I would rate it as a nine out of 10. It has been very good. In terms of our use cases, it has met them very well. To move that up to a 10, changes to its reporting features would definitely make this product a lot better. Also, increasing the vendor specific features coverage and making sure that they are normalizing every aspect of each type of firewall.
Which deployment model are you using for this solution?
On-premises
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Brendan, thank you for taking the time to write a review of FireMon. I am glad to see you are finding overall satisfaction with the product. Please feel free to drop us a note at customersuccess@firemon.com for any future questions or concerns.