In short: Cisco Secure Firewall Management Center (FMC), formerly Firepower Management Center, centrally manages Threat Defense firewalls: policy, IPS, application and URL control, malware defence, events and upgrades. It runs on a Cisco appliance, as a virtual machine or in public cloud, or as the cloud-delivered Management Center in Security Cloud Control. Device Manager handles single firewalls.
What is Firewall Management Center?
Firewall Management Center, or FMC, is where you build and deploy policy for Secure Firewall Threat Defense devices. It was called Firepower Management Center (and before that FireSIGHT and Defense Center), and Cisco's current documentation often shortens it to Firewall Management Center.
From one console you can:
- Write access control, NAT, VPN, decryption and identity policies once and deploy them to many firewalls
- Manage Snort 3 intrusion policies, file and malware policies and URL filtering
- Analyse connection, intrusion, file and malware events, with host and user context
- Schedule Talos rule, vulnerability database and geolocation updates, and plan software upgrades
- Assign licences to devices through Cisco Smart Licensing
- Integrate with Cisco XDR, Security Analytics and Logging, ISE and Secure Workload
The cloud-delivered Management Center includes the Cisco AI Assistant, which answers questions about your policies, proposes rules for you to approve and flags duplicate or shadowed rules. Version 10 redesigned the Management Center menus to match Security Cloud Control and lets several administrators edit the same access control policy at once, merging changes that do not conflict.
Deployment options
- Hardware appliance: Cisco offers appliances in several sizes, sized by the number of firewalls managed, which keeps management and event data on your own premises
- Virtual (FMCv): runs on VMware, KVM, Nutanix and other private cloud platforms, and is licensed by the number of devices it manages
- Public cloud: Management Center Virtual can run in AWS, Microsoft Azure, Google Cloud and Oracle Cloud to manage on-premises and cloud firewalls
- Cloud-delivered Management Center (cdFMC): hosted by Cisco inside Cisco Security Cloud Control, so there is no management software for you to update
You can also keep an on-premises Management Center and connect it to Security Cloud Control, which Cisco says adds policy analysis, best-practice recommendations and feature adoption insights at no upfront cost, or move devices fully to cloud management later. Cisco publishes guidance on migrating from on-premises to cloud-delivered management.
FMC vs cdFMC vs Device Manager
| Management Center (on-premises or virtual) | Cloud-delivered Management Center | Secure Firewall Device Manager | |
|---|---|---|---|
| Where it runs | Your data centre, private cloud or public cloud account | Cisco's cloud, inside Security Cloud Control | On the firewall itself |
| Manages | Many Threat Defense devices | Many Threat Defense devices, alongside ASA and other products in Security Cloud Control | One device |
| Who maintains it | You (or us): upgrades, backups, sizing | Cisco maintains and updates it | Upgraded with the device |
| Event storage | On the Management Center | Cloud logging (Security Analytics and Logging) | Limited local events |
| Air-gapped networks | Yes, with offline licensing options | No, needs cloud connectivity | Yes |
| Typical fit | Larger estates, data residency on premises, high event volumes | Distributed estates that want less infrastructure | Single sites and small offices |
| Licensing | Hardware needs no platform licence; the virtual edition is licensed by device count | Per-device subscription through Security Cloud Control; ask us for a quote | No separate management licence |
Which should you choose?
A few practical rules we use with UK customers:
- One or two firewalls with simple policy: Device Manager, or cloud-delivered Management Center if you want room to grow
- Many branches and a small IT team: cloud-delivered Management Center, so nobody has to maintain a management server
- Strict data handling, air-gapped sites or very high event volumes: on-premises hardware or virtual Management Center
- Mixed ASA and Threat Defense estates during a migration: Security Cloud Control, which manages both
Moving between options is possible but involves re-registering devices, so it is worth deciding early. If your Management Center appliance is due for refresh, compare replacing it with the cloud-delivered option: Cisco provides a savings calculator for this, and we can work through it with you.
How we help
We install and configure Management Center, migrate policy from older Firepower Management Center versions or from ASA (using the Secure Firewall Migration Tool), move estates to cloud-delivered management, and run upgrades and health checks. Contact us to talk through your estate; ask us for a quote for licences and services.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Firepower Management Center the same as Secure Firewall Management Center?
Yes. Cisco renamed Firepower Management Center to Secure Firewall Management Center, and its documentation now often uses the short form Firewall Management Center. FMC remains the common abbreviation.
What is cdFMC?
cdFMC is the cloud-delivered Firewall Management Center, a version of Management Center that Cisco hosts and maintains inside Security Cloud Control. It has the same look and feel as the on-premises version and manages Threat Defense devices without an on-premises server.
Does Firewall Management Center need a licence?
A physical Management Center appliance does not need a platform licence. Management Center Virtual needs a platform licence sized by the number of devices it manages, and the firewalls themselves need their own feature licences.
Can Management Center manage Cisco ASA?
No. Management Center manages Threat Defense devices. ASA is managed with ASDM, the command line or Security Cloud Control, which can handle ASA and Threat Defense side by side.
What is Secure Firewall Device Manager?
Device Manager (formerly Firepower Device Manager, FDM) is the web interface built into a Threat Defense firewall for managing that single device without a Management Center.