We currently use the security manager modules to clean and fine-tune our set of policies centrally. We additionally use a policy planner to automate our process of routine operations in policy sets.
Pros
Cleaning policy sets.
Policy set automation.
Detailed analysis of the policies to be implemented.
Cons
Keep up with new features implemented by security vendors.
Likelihood to Recommend
Environments where it is required to automate firewall security operations activities. Where it is required to have detailed change audit controls.
VU
Verified User
Manager in Information Technology (1001-5000 employees)
We use FireMon to track changes in traffic, find rules that we can clean up and restrict, and report to higher-ups. I personally use it to export lists of potential rules to change based on control failures. We use it in most of our separate business units for a variety of reasons, but most are using it to improve security posture.
Pros
Regular reporting.
Dashboarding
Cons
When my query is too complicated, the search bar changes to an advanced mode. I'd love for it to always be capable of the beginner mode since it takes a long time to get all the pieces of the query I need in advanced mode.
Sometimes our active VPN tunnels will show "unused" in FireMon when they are used.
I use the allowlisting feature frequently, but it's not possible to bulk-allowlist items.
I'd love to be able to report on new control failures. There are a lot of reporting options available, but it seems like a manual export of a CSV is my only choice if I want to look at control failures.
Likelihood to Recommend
FireMon is best used in a large environment (for example, I have >100
firewalls in my environment). It's best used when trying to improve
security posture and showing changes in firewall security over time. It
might not be the best choice for smaller environments or those that aren't concerned about security management.
We use firemon to real time reporting when a change occurs in addition to using it for a biannual clean of any rules that have not been used for 90 days.
Pros
Give good real time reporting for anyone making a change to any of our firewalls
Provides good reporting tools that are out of box
Provide good customization tools that is specific to our needs
Upgrades are a simple process and support does relatively well with assisting us.
Cons
There support could be better in terms of having more SME's for their product.
FireMon should have a video repository to make it easier on how to use their product
customizing reports should be made simpler. If we are looking for a specific date range (e.g., 90 day report on what rules have been used, then it should be able to give us this information) however in our past experience this hasn't always been the case
Likelihood to Recommend
Firemon product is overall good a product. It gives us a summary of who made what change, when it occurred and at what time, in real time. Their Out of box tools do satisfy the common requests for reporting and there options to create customized report allows us for more options as every environment is different. That is why I gave it an 8 rating.
VU
Verified User
Administrator in Information Technology (1001-5000 employees)
We use FireMon to analyze and automatically manage firewall rules for our Palo Alto firewalls.
Pros
Rule analysis
Compliance
Identify errors
Cons
Automation
Reporting
Alerting
Likelihood to Recommend
What FireMon is good at: - Single pane-of-glass console for unified visibility and management - Policy standardization and automation tools simplify and decrease the time to create and deploy rules - Preconfigured control sets and scheduling for on-demand and automated PCI-DSS compliance report generation
Room for improvement:
- Policy management for cloud vendors
VU
Verified User
Team Lead in Information Technology (10,001+ employees)
We use FireMon Daily. It helps to organize and monitor Firewall policy Health, identify issues and act on them. It is great for rule cleanup and compliance checks. It generates data that can be given to management as well as auditors. Policy Optimizer as well as Custom Reports free up a lot of time that engineers can spend on more valuable tasks.
Pros
Hitcount Data and Integrity checks of Firewall Rules
Traffic Flow Analysis and Rule Usage Reports to help clean up overly permissive rules.
Easy way to check specific access allowed in a company across multiple vendors.
Automate reviews of Rules with Policy Optimizer tickets.
Cons
Focus on the 20% of the product that appears unpolished, such as Mapping and Risk Analyzer
Understand that certain changes might benefit compatibility with one vendor, but hurt compatibility with another
Add more support for more advanced features that vendors have to offer
Clean up deployment images, such as wasted disk space on directories not applicable to a server role
Likelihood to Recommend
I recommend FireMon to consultants or companies needing improvement or monitoring of a rulebase, as if you are looking at 100s or 1000s of firewalls, it the single pane of glass allows you to get a picture rather quickly (especially if multivendor). Companies who must follow PCI, as their reports are exactly what PCI auditors are looking for. I would not recommend FireMon or its competitors to a company that has less than 10 firewalls (or vsyses), as I don't feel it would be worth it.
VU
Verified User
Engineer in Information Technology (5001-10,000 employees)
We use FireMon to validate rules, test traffic pathing and to do TFAs for minimizing overly permissive rules.
Pros
TFA and TFA output is fantastic
Finding misconfigured rules is very easy
We arent leveraging very much from FireMon
Cons
The support site isnt the best
Likelihood to Recommend
The ability to find an overly permissive rule and then leverage TFA to monitor the rule's traffic with the output being easily consumable is incredibly valuable.
Firemon is an awesome Audit tool, recently this tool has helped us to identify the traffic that is hitting a particular rule. I highly recommend Firemon when it comes to hardening the firewall rules.
Pros
Audit
Identify traffic
Hardening Firewall Rules
Cons
NAT logging seems to be not supported
It is able to draw the network's topology. However, because it can't see certain things, it doesn't draw the full story but it is still extremely helpful. We also have asymmetric routing, which causes a challenge. FireMon could improve its end-user practices. As an end user, I am just trying to catch up on all the alerts. There are so many, and you still have to go through them and document what was found
FireMon could be easier to use and flexibility regarding reporting could be improved.
Likelihood to Recommend
It is able to draw the network's topology AND to
identify the traffic that is hitting this rule. NAT logging seems to be not supported.
We use the PCI reports available on the appliance in order to know the levels of compliance of our business.
Pros
Detailed reports
Unused firewall rules
Visibility of the whole configuration
Cons
Have one only access to configure the appliance and handle reports
Likelihood to Recommend
Scenarios where any customer handle different brands of appliances this tool helps to get reports of all of them. Scenarios where you only have one unique brand this tool may not be the best option.
I use it for reporting and checking for unused firewall rules to do cleanup. I am still new to the Firemon product, so I have not used all of its functions.
Pros
Reporting
Dashboard
Rules changes.
SIQL query.
Cons
SIQL query is good but not easy to use.
Query interface for advanced does not always has basic query conversion.
The report have a lot of info that I need to filter it out.
Likelihood to Recommend
The dashboard is very good, so you can get reporting in one central location for all company firewalls. You cannot make firewall rule change on Firemon Security Manager.
