FireMon

Environments where it is required to automate firewall security operations activities. Where it is required to have detailed change audit controls.

FireMon is best used in a large environment (for example, I have >100 firewalls in my environment). It's best used when trying to improve security posture and showing changes in firewall security over time. It might not be the best choice for smaller environments or those that aren't concerned about security management.

Firemon product is overall good a product. It gives us a summary of who made what change, when it occurred and at what time, in real time. Their Out of box tools do satisfy the common requests for reporting and there options to create customized report allows us for more options as every environment is different. That is why I gave it an 8 rating.

What FireMon is good at:
- Single pane-of-glass console for unified visibility and management
- Policy standardization and automation tools simplify and decrease the time to create and deploy rules
- Preconfigured control sets and scheduling for on-demand and automated PCI-DSS compliance report generation

Room for improvement:

- Policy management for cloud vendors

Better suited for: Compiling a historical record of changes/revisions of network appliances. Understanding rule set complexity in terms of overlapping rules and redundancy. Understanding and viewing rule usage. Understanding network flow--how packets will traverse from this hop to the next. What compliance risks are present due to failed controls.

I recommend FireMon to consultants or companies needing improvement or monitoring of a rulebase, as if you are looking at 100s or 1000s of firewalls, it the single pane of glass allows you to get a picture rather quickly (especially if multivendor). Companies who must follow PCI, as their reports are exactly what PCI auditors are looking for. I would not recommend FireMon or its competitors to a company that has less than 10 firewalls (or vsyses), as I don't feel it would be worth it.

The ability to find an overly permissive rule and then leverage TFA to monitor the rule's traffic with the output being easily consumable is incredibly valuable.

Firemon is a more budget option one can look up if they are looking to manage something like cisco, Paloalto, checkpoint or FortiGate. It is not that great with another brand of firewalls like NSX or other ones that are not that much out there.

It is able to draw the network's topology AND to identify the traffic that is hitting this rule. NAT logging seems to be not supported.

Scenarios where any customer handle different brands of appliances this tool helps to get reports of all of them.
Scenarios where you only have one unique brand this tool may not be the best option.

The dashboard is very good, so you can get reporting in one central location for all company firewalls. You cannot make firewall rule change on Firemon Security Manager.

The tool give the customer a lot of visibility about the appliances in general.

1. We used FireMon mainly on reviewing firewall policies that are high risk or that are not being used in the network anymore. We are able to configure several thresholds wherein once there are no hit counts for atleast 60 days (2 months) there will be an alert to us administrators. 2. We also use several dashboards that are shared to executive personnel for them to see what is going on in our internal and external perimeters.

good selection of canned reports in various areas, helpful in troubleshooting issues (firewall changes, health)

The networking team needed insight into traffic for a particular application and had reached out to see if FireMon could provide insight into the traffic flow to help with troubleshooting. It simply made a traffic report that was auto emailed to the team about the issue, and it gave great insight on how often it was being used.

Great when testing new/changed firewall rules especially as a 'check and balance' with other network tools.

Firemon does a good job of a one page view dashboard. It is also useful when you have a multi-vendor environment,

Excellent for enterprise work intake for and managing SLAs.

FireMon is very well suited to handle small to midsize networks for total configuration management/rule deployment/reporting. I think where FireMon is less suited is handling larger networks with higher amounts of traffic. To be fair to FireMon, we probably should have been informed by the original sales team (no longer with the company) that we would need more hardware in order to function properly with our network. We've had to use clever workarounds to get basic data from our devices into the product. I do not think this is a problem in all larger organizations but in ours where firewall logging accounts for most logs in the environment, we do have some issues. Update: Firemon is using a lot of different scaling tricks so that you can dedicate servers to functions or load balance the same functions across multiple servers. This won't help with a large environment with routes that don't make much sense but it should help permit the ability to log a lot of traffic if you supply the correct hardware to do so.

Within my industry I have multiple contacts that are looking for exactly what Firemon does. Not only can the software help compliance professional but also network engineers who need a better picture of how infrastructure is set up. As well as new employees that need to learn the environment quickly.

We have multiple firewalls in our corporate environment that are from the same vendor, and while this vendor does provide a single console for management, it falls short of being able to do the proper kind of management that you'd need to a large, complex network. FireMon allows for the firewall team to management and monitor the firewall, including rules, paths, and issues in a single environment. Along with the ability to test and troubleshoot route and path issues, which makes life much easy and makes fixing problem much quicker

I think the flexibility of scheduling the config pulls and the flexibility on the architecture (1 box versus as many as you want) are very nice.

FireMon is best suited for change control monitoring and compliance in our organization.
FireMon has enabled us to monitor firewalls from one console, and has support for new models from Palo Alto which we currently use.

FireMon is well suited for rule analysis and compliance

FireMon is a great tool, but it is very expensive to run. Also the last sale rep we had was very aggresive and didnt respect the fact we told them that we were not interested at the time to upgrade or add any additional licensing.