Cisco FMC Firewall Operations
MCP Server
- Repository: CiscoDevNet/CiscoFMC-MCP-server-community
- Transport: HTTP (
http://<host>:8000/mcp) — requires HTTPS reverse proxy for production
- Install:
git clone + pip install -r requirements.txt + python -m sfw_mcp_fmc.server (or Docker)
- Requires:
FMC_BASE_URL, FMC_USERNAME, FMC_PASSWORD
Available Tools (4)
| Tool |
What It Does |
list_fmc_profiles |
Discover all configured FMC instances (single or multi-FMC mode). Returns profile IDs, display names, and aliases. Use this first to select which FMC to query. |
find_rules_by_ip_or_fqdn |
Search rules within a specific access policy by IP address or FQDN. Matches source/destination network objects against the given indicator. |
find_rules_for_target |
Resolve FTD devices or HA clusters to their assigned access policies, then search those policies. Use when you know the firewall device name but not the policy name. |
search_access_rules |
FMC-wide rule search with multiple filter types: network indicators (IP, FQDN), identity indicators (SGT tags, realm users/groups), and policy name filters. The most powerful search tool. |
Key Concepts
| Concept |
What It Means |
| FMC |
Firepower Management Center — centralized management for Cisco Secure Firewalls (FTD) |
| FTD |
Firepower Threat Defense — the firewall appliance/virtual managed by FMC |
| Access Policy |
Collection of access rules (ACLs) applied to FTD devices — permit/deny by source/dest/port/app |
| Access Rule |
Individual rule within a policy — source zones, dest zones, source/dest networks, ports, action (allow/block/monitor) |
| SGT |
Security Group Tag — TrustSec identity-based tag for micro-segmentation |
| HA Cluster |
High Availability pair of FTD devices sharing the same policy |
| Profile |
FMC connection configuration (URL, credentials) — supports multi-FMC environments |
Workflow: Firewall Rule Audit
When a user asks "what firewall rules exist for 10.1.1.0/24?":
- Discover FMCs:
list_fmc_profiles — identify which FMCs manage this network
- Search rules:
search_access_rules with network indicator 10.1.1.0/24
- For each match: Extract rule name, action (allow/block), source/dest zones, source/dest networks, ports, logging settings
- Cross-reference: Check if rules are overly permissive (any/any), redundant, or shadowed
- Report: Formatted rule table with security assessment
Workflow: "Can Host A Reach Host B?"
When investigating connectivity through the firewall:
- Identify FTD: Which firewall sits between source and destination?
- Resolve policy:
find_rules_for_target with the FTD device name
- Search source IP:
find_rules_by_ip_or_fqdn for the source IP in the resolved policy
- Search dest IP: Same for destination IP
- Analyze: Do the matching rules permit the required port/protocol?
- Report: "Traffic from 10.1.1.50 to 10.2.1.100:443 is ALLOWED by rule 'Web-Servers-Inbound' (line 47)" or "BLOCKED by implicit deny"
Workflow: Security Group Tag (SGT) Policy Review
When auditing TrustSec/SGT-based policies:
- Search by SGT:
search_access_rules with identity indicator for a specific SGT value
- List matching rules: Which rules reference this SGT in source or destination?
- Check actions: Are SGT-based rules enforcing proper segmentation?
- Cross-reference: Use
ise-posture-audit to verify SGT assignment policies in ISE
- Report: SGT policy coverage analysis
Workflow: Multi-FMC Environment Audit
When managing multiple FMC instances:
- List all FMCs:
list_fmc_profiles — see all managed FMC instances
- For each FMC:
search_access_rules with common indicators
- Compare policies: Are policies consistent across FMCs?
- Identify drift: Rules present in one FMC but not another
- Report: Cross-FMC policy consistency analysis
Integration with Other Skills
| Skill |
How They Work Together |
pyats-security |
FMC rule audit + device-level ACL verification via pyATS |
ise-posture-audit |
FMC SGT rules + ISE SGT assignment and TrustSec matrix |
ise-incident-response |
FMC rules for quarantine verification + ISE endpoint investigation |
aws-security-audit |
Cross-platform security: FMC on-prem + AWS cloud security posture |
gcp-cloud-logging |
FMC firewall logs vs GCP firewall logs for hybrid environments |
nso-device-ops |
FMC policies + NSO device config for end-to-end policy view |
servicenow-change-workflow |
ServiceNow CR gating before any FMC policy modifications |
github-ops |
Commit FMC rule snapshots to Git for config-as-code tracking |
Multi-FMC Configuration
Single FMC mode (set in .env):
FMC_BASE_URL=https://fmc.example.com
FMC_USERNAME=api-user
FMC_PASSWORD=changeme
FMC_VERIFY_SSL=false
Multi-FMC mode (profile directory):
profiles/
dc-east.env # FMC for DC East
dc-west.env # FMC for DC West
dmz.env # FMC for DMZ firewalls
Each profile .env contains:
FMC_PROFILE_ID=dc-east
FMC_PROFILE_DISPLAY_NAME=DC East FMC
FMC_PROFILE_ALIASES=10.1.1.10,fmc-east
FMC_BASE_URL=https://fmc-east.example.com
FMC_USERNAME=api-user
FMC_PASSWORD=changeme
FMC_VERIFY_SSL=false
Important Rules
- Read-only — all 4 tools are search/query operations; no rule modifications
- HTTP transport — server runs on port 8000, front with HTTPS proxy for production
- Multi-FMC — always call
list_fmc_profiles first to select the right FMC instance
- FMC API rate limits — FMC REST API has per-user rate limits; avoid rapid-fire queries
- Record in GAIT — log all firewall policy investigations for audit trail
Environment Variables
FMC_BASE_URL — FMC URL (e.g., https://fmc.example.com)FMC_USERNAME — FMC API usernameFMC_PASSWORD — FMC API passwordFMC_VERIFY_SSL — SSL verification (true/false)FMC_PROFILES_DIR — path to multi-FMC profiles directory (optional)FMC_PROFILE_DEFAULT — default profile name (optional)
1---
2name: fmc-firewall-ops
3description: "Cisco Secure Firewall FMC — access policy search, rule inspection, FTD device targeting, multi-FMC profile management. Use when searching firewall rules by IP or FQDN, checking if host A can reach host B through the firewall, auditing FMC access policies, or reviewing SGT-based segmentation rules."
4version: 1.0.0
5license: Apache-2.0
6tags: [cisco, fmc, firewall, ftd, security, access-policy, firepower]
7---
8
9# Cisco FMC Firewall Operations
10
11## MCP Server
12
13- **Repository**: [CiscoDevNet/CiscoFMC-MCP-server-community](https://github.com/CiscoDevNet/CiscoFMC-MCP-server-community)
14- **Transport**: HTTP (`http://<host>:8000/mcp`) — requires HTTPS reverse proxy for production
15- **Install**: `git clone` + `pip install -r requirements.txt` + `python -m sfw_mcp_fmc.server` (or Docker)
16- **Requires**: `FMC_BASE_URL`, `FMC_USERNAME`, `FMC_PASSWORD`
17
18## Available Tools (4)
19
20| Tool | What It Does |
21|------|-------------|
22| `list_fmc_profiles` | Discover all configured FMC instances (single or multi-FMC mode). Returns profile IDs, display names, and aliases. Use this first to select which FMC to query. |
23| `find_rules_by_ip_or_fqdn` | Search rules within a specific access policy by IP address or FQDN. Matches source/destination network objects against the given indicator. |
24| `find_rules_for_target` | Resolve FTD devices or HA clusters to their assigned access policies, then search those policies. Use when you know the firewall device name but not the policy name. |
25| `search_access_rules` | FMC-wide rule search with multiple filter types: network indicators (IP, FQDN), identity indicators (SGT tags, realm users/groups), and policy name filters. The most powerful search tool. |
26
27## Key Concepts
28
29| Concept | What It Means |
30|---------|---------------|
31| **FMC** | Firepower Management Center — centralized management for Cisco Secure Firewalls (FTD) |
32| **FTD** | Firepower Threat Defense — the firewall appliance/virtual managed by FMC |
33| **Access Policy** | Collection of access rules (ACLs) applied to FTD devices — permit/deny by source/dest/port/app |
34| **Access Rule** | Individual rule within a policy — source zones, dest zones, source/dest networks, ports, action (allow/block/monitor) |
35| **SGT** | Security Group Tag — TrustSec identity-based tag for micro-segmentation |
36| **HA Cluster** | High Availability pair of FTD devices sharing the same policy |
37| **Profile** | FMC connection configuration (URL, credentials) — supports multi-FMC environments |
38
39## Workflow: Firewall Rule Audit
40
41When a user asks "what firewall rules exist for 10.1.1.0/24?":
42
431. **Discover FMCs**: `list_fmc_profiles` — identify which FMCs manage this network
442. **Search rules**: `search_access_rules` with network indicator `10.1.1.0/24`
453. **For each match**: Extract rule name, action (allow/block), source/dest zones, source/dest networks, ports, logging settings
464. **Cross-reference**: Check if rules are overly permissive (any/any), redundant, or shadowed
475. **Report**: Formatted rule table with security assessment
48
49## Workflow: "Can Host A Reach Host B?"
50
51When investigating connectivity through the firewall:
52
531. **Identify FTD**: Which firewall sits between source and destination?
542. **Resolve policy**: `find_rules_for_target` with the FTD device name
553. **Search source IP**: `find_rules_by_ip_or_fqdn` for the source IP in the resolved policy
564. **Search dest IP**: Same for destination IP
575. **Analyze**: Do the matching rules permit the required port/protocol?
586. **Report**: "Traffic from 10.1.1.50 to 10.2.1.100:443 is ALLOWED by rule 'Web-Servers-Inbound' (line 47)" or "BLOCKED by implicit deny"
59
60## Workflow: Security Group Tag (SGT) Policy Review
61
62When auditing TrustSec/SGT-based policies:
63
641. **Search by SGT**: `search_access_rules` with identity indicator for a specific SGT value
652. **List matching rules**: Which rules reference this SGT in source or destination?
663. **Check actions**: Are SGT-based rules enforcing proper segmentation?
674. **Cross-reference**: Use `ise-posture-audit` to verify SGT assignment policies in ISE
685. **Report**: SGT policy coverage analysis
69
70## Workflow: Multi-FMC Environment Audit
71
72When managing multiple FMC instances:
73
741. **List all FMCs**: `list_fmc_profiles` — see all managed FMC instances
752. **For each FMC**: `search_access_rules` with common indicators
763. **Compare policies**: Are policies consistent across FMCs?
774. **Identify drift**: Rules present in one FMC but not another
785. **Report**: Cross-FMC policy consistency analysis
79
80## Integration with Other Skills
81
82| Skill | How They Work Together |
83|-------|----------------------|
84| `pyats-security` | FMC rule audit + device-level ACL verification via pyATS |
85| `ise-posture-audit` | FMC SGT rules + ISE SGT assignment and TrustSec matrix |
86| `ise-incident-response` | FMC rules for quarantine verification + ISE endpoint investigation |
87| `aws-security-audit` | Cross-platform security: FMC on-prem + AWS cloud security posture |
88| `gcp-cloud-logging` | FMC firewall logs vs GCP firewall logs for hybrid environments |
89| `nso-device-ops` | FMC policies + NSO device config for end-to-end policy view |
90| `servicenow-change-workflow` | ServiceNow CR gating before any FMC policy modifications |
91| `github-ops` | Commit FMC rule snapshots to Git for config-as-code tracking |
92
93## Multi-FMC Configuration
94
95Single FMC mode (set in `.env`):
96```
97FMC_BASE_URL=https://fmc.example.com
98FMC_USERNAME=api-user
99FMC_PASSWORD=changeme
100FMC_VERIFY_SSL=false
101```
102
103Multi-FMC mode (profile directory):
104```
105profiles/
106 dc-east.env # FMC for DC East
107 dc-west.env # FMC for DC West
108 dmz.env # FMC for DMZ firewalls
109```
110
111Each profile `.env` contains:
112```
113FMC_PROFILE_ID=dc-east
114FMC_PROFILE_DISPLAY_NAME=DC East FMC
115FMC_PROFILE_ALIASES=10.1.1.10,fmc-east
116FMC_BASE_URL=https://fmc-east.example.com
117FMC_USERNAME=api-user
118FMC_PASSWORD=changeme
119FMC_VERIFY_SSL=false
120```
121
122## Important Rules
123
124- **Read-only** — all 4 tools are search/query operations; no rule modifications
125- **HTTP transport** — server runs on port 8000, front with HTTPS proxy for production
126- **Multi-FMC** — always call `list_fmc_profiles` first to select the right FMC instance
127- **FMC API rate limits** — FMC REST API has per-user rate limits; avoid rapid-fire queries
128- **Record in GAIT** — log all firewall policy investigations for audit trail
129
130## Environment Variables
131
132- `FMC_BASE_URL` — FMC URL (e.g., `https://fmc.example.com`)
133- `FMC_USERNAME` — FMC API username
134- `FMC_PASSWORD` — FMC API password
135- `FMC_VERIFY_SSL` — SSL verification (true/false)
136- `FMC_PROFILES_DIR` — path to multi-FMC profiles directory (optional)
137- `FMC_PROFILE_DEFAULT` — default profile name (optional)
gabrielmoreira