topic Re: Replacement for Cisco security Manager in Network Security

Replacement for Cisco security Manager

hoffa2000 — Wed, 30 Oct 2019 06:42:13 GMT

Hi all

I've been using CSM for years managing several ASAs and access lists on our internal core routers. All ASAs are soon replaced by Firepower Threat Defences and in this age of cloud/web based management CSM feels really old. I've had help from our partner checking for options in the Cisco product suite but none has yet felt like a clear replacement for ACL management on a router platform.

So I'm searching far and wide, this being a Cisco forum but does anyone have any suggestions on how to manage router ACLs these days? I mean router ACLs is still a relevant feature these days, right?

Regards

Fredrik

Re: Replacement for Cisco security Manager

Rob Ingram — Wed, 30 Oct 2019 09:35:01 GMT

Hi,
The obvious (to me) replacement for CSM is CDO (Cisco Defense Orchestrator), this is a cloud managed platform to manage cisco platforms such as ASA, Firepower, Umbrella and to a lesser extent IOS devices. I don't think you can really manage IOS device ACLs to the same extent as you can manage ASA or FTD firewall rules. Other cisco solutions such as ISE/SDA deploy and manage Trustsec SGACLs on IOS devices, which could be considered as replacements/alternative for ACLs.

HTH

Re: Replacement for Cisco security Manager

hoffa2000 — Wed, 30 Oct 2019 10:40:53 GMT

Our Cisco partner did some research into CDO and advised us it wasn't intended for IOS management. For example was there no license aimed at the IOS devices, only firewalls and we will not manage those through CDO.

/Fredrik

Re: Replacement for Cisco security Manager

Rob Ingram — Wed, 30 Oct 2019 10:53:02 GMT

Yes, management of IOS devices is certainly limited compared to other solutions on CDO. CSM is still being updated however, there was an update released only recently. Perhaps Cisco Prime Infrastructure meets your requirements, it can be configured to deploy templates for ACLs etc...although I personally have never used it.

Re: Replacement for Cisco security Manager

Marvin Rhoads — Wed, 30 Oct 2019 12:12:06 GMT

CDO does not currently support IOS device management.

There are non-Cisco products such as Tufin Orchestration Suite (TOS) SecureTrack that support ASA, FTD, IOS etc.:
https://forum.tufin.com/support/kc/latest/index.htm#Suite/11198.htm

It will be "reassuringly expensive" though.