Connect the Management Center once and SmartTile sees every Threat Defense firewall behind it — inventory, health, confirmed outages with a ticket, daily log exports, versioned configuration snapshots, admin-login alerts and Cisco advisories — with the firewalls themselves left untouched.
fmc_platform/v1 + fmc_config/v1), plus a syslog receiver the firewalls send to.An FTD watched by ping answers one question. The Management Center already knows every firewall's model, software version, HA role, health and pending deployments, and who logged in to change what. SmartTile signs in to the FMC with a dedicated API user — Read Only is enough for monitoring — and turns what it knows into devices, tickets and documents on the same pane as the rest of the network.
Every managed FTD listed as new, linked, imported or offline. Tick the ones you want; one already pinged by IP is linked, never duplicated. Model, serial and version are written to the device and kept fresh each poll.
With Monitor via FMC health, RED for 3 polls (~15 min) = DOWN; an FTD the FMC stops listing = DOWN after 3. Each change lands in state history and a new DOWN opens a Rev.io ticket. All three counts are tunable.
If SmartTile cannot reach the FMC for 3 polls, its firewalls turn UNKNOWN and the NOC gets one e-mail — a dead FMC or expired password never shows an estate as healthy.
Devices, interfaces, static routes, HA pairs, access and NAT policies and rules, objects and security zones — one JSON bundle daily, stored only when it changed, with a section-by-section compare.
Daily at the hour you pick: audit records, health alerts, health metrics (CPU, memory, disk), inventory, pending deployments and the FMC's backup-file list — each as CSV plus raw JSON.
FMC audit logins, logouts, failed logins and changes, by user and source IP. A login not on the allow-list, or repeated failures, opens a ticket and e-mails the contacts you choose.
Cisco PSIRT advisories flagged against your running FMC and FTD versions. FirmwareAutomate spots an upgrade package on the FMC newer than an FTD's version, and tickets, schedules and verifies it.
FTDs and the FMC can send syslog (UDP/TCP 514) to SmartTile — connection, intrusion, file and audit events the REST API does not carry. Only known firewall addresses are accepted.
smarttile, long random password, role Read Only. Add an Administrator user later only for native backups or changes.smarttile user signing in every half hour in the FMC audit log is expected.| FMC user | What works |
|---|---|
| Read Only | Inventory and import, health and DOWN detection, config snapshots, log exports, backup-file list, advisories, firmware detect → ticket → verify. |
| + Administrator (optional second user) | Adds native FMC/FTD backups and reads a Read Only user is refused (e.g. pending deployments on 7.6). Still no writes unless Allow write actions is switched on. |
| Allow write actions · off by default | Deploy pending changes; create, edit, delete host / network / port objects; start an FTD upgrade from FirmwareAutomate (also needs the platform switch, off by default). |
/api/fmc_platform/v1/auth/generatetokensign in (Basic); refreshtoken renews it/api/fmc_platform/v1/info/serverversionFMC version, VDB, SRU…/devices/devicerecordsevery FTD: model, serial, version, health…/devicehapairs/ftddevicehapairsHA role (primary / secondary)…/health/alerts · /health/metricshealth alerts; CPU, memory, disk…/audit/auditrecordswho signed in and changed what…/deployment/deployabledevicespending deployments…/policy/accesspolicies · ftdnatpoliciesrules for the config snapshot…/object/networks · hosts · portsobjects and security zones…/updates/upgradepackagesupgrade packages + applicable devices…/backup/operational/devicebackupnative FTD backup — Administrator only…/deployment/deploymentrequestsdeploy — only with write actions onBoth FMC passwords and the PSIRT client secret are encrypted at rest. The API returns only has password flags — the field reads blank on edit — and tokens are never logged.
Every change sits behind a second Administrator user and Allow write actions, off by default. Each attempt is written to a change ledger with the request, the FMC's answer and who.
Admins see and manage only their own company's FMC connections. Every create, edit, backup, export and change is written to the transaction log with user, time and source IP.
One switch turns the whole integration off without a redeploy, plus a server kill switch; the syslog receiver has its own. Down counts, export hour and snapshot hour are set per FMC.
| Objection | Answer |
|---|---|
| “You would have write access to our firewalls.” | Not with a Read Only user — the FMC itself refuses. Writes need a second Administrator user and a switch that is off by default, and each one is ledgered. |
| “We don't expose the FMC to the internet.” | Allow HTTPS from one SmartTile address, or reach a private FMC over the site VPN tunnel. Event logs come the other way, by syslog from the firewalls. |
| “A policy deploy turns health red for a minute.” | One RED poll changes nothing. DOWN needs 3 consecutive polls by default, and you can set it anywhere from 1 to 30. |
| “We already have FMC dashboards.” | SmartTile puts the FTDs beside your circuits, switches and access points, opens the ticket, and keeps the logs and snapshots in Documents for the audit. |