More than 50 Domains

[Firepowered]

Hello

I am on FMC 6.2.3, for visibility purpose (data usage etc) our initial deployment was such that every Site (Firewall) was configured as a separate domain. We are nearing the limit of 50 domains, obviously there are many others "sites" (Firewalls) that need to be added.

What is the way forward without buying an FMC for a region each?

PS: Our sites are spread across the Globe, region wise.

Thank you very much.

[balaji.bandi]

At this moment you do not have any other option - FMC only.

Maybe you can do Role-based Access from Centralise FMC - to maintain their own domain FTD.

make sense?

[Firepowered]

Thank you, Balaji.

I am lost, sorry.

[Marvin Rhoads]

How you're using Firepower domains is a bit outside their intended purpose.

Have you considered adopting CDO as your management platform? It may address your requirements more easily.

[Firepowered]

Thanks Marvin.

The current design is strange, I believe the intention was to gather data site (Site) wise, but I can only guess. Btw, what really is the purpose of the Domains then?

No, I don't know much about CDO. Could you please link me up? How will it help us?

I am interested to know how we can continue using Firepower services across our estate without bothering too much about domains etc, or even redesigning!

[balaji.bandi]

here is the CDO information :

https://www.cisco.com/c/en/us/products/collateral/security/defense-orchestrator/datasheet-c78-736847.html

[Marvin Rhoads]

Domains are used for separation of administrative responsibilities. For example, the European team manages their own policies and devices while the Asia Pacific team manages theirs. They can also be used in a managed service provider scenario where customers manage their respective systems.

[Firepowered]

Thanks Marvin.

CDO might not be possible right now.

Since I am out of "Domains" already, and I have 3-4 sites to add, what are my options? I am thinking restructuring domains region wise should suffice, EMEA / APAC / US etc.