Introduction

Network as Code allows for complete separation of data (defining variables) from logic (infrastructure declaration). With little to no knowledge about automation, users can configure Cisco Secure Firewall Management Center (FMC) objects, access control policy, and device registration in minutes, using the same constructs familiar from the FMC GUI. This is achieved by separating the *.yaml files which contain the desired FMC state from the Terraform Modules which map the definition of the desired state to Terraform resources. The data model and modules used in Network as Code are open-source and available as-is. For support and or customization it is required to engage with Cisco Professional Services.

The tree output below shows an example of a data model where the *.yaml files compose logical groups that map to the sections FMC users are already familiar with from the admin console.

• Directorydata

  • objects.nac.yaml
  • policies.nac.yaml
  • devices.nac.yaml
• main.tf

Configuration can simply be managed via YAML files. Below is a simple example defining a host object, nested under the Global domain:

---
fmc:
  domains:
    - name: Global
      objects:
        hosts:
          - name: Server1
            ip: 10.1.2.3

FMC Provider

Unlike device-based providers that connect over NETCONF or NX-API, the Terraform provider for FMC manages configuration on a single Cisco Secure Firewall Management Center (FMC) — or its cloud-delivered counterpart (cdFMC) — over its REST API. Authentication depends on the target:

• Self-hosted FMC: a username and password.
• cdFMC / Security Cloud Control (SCC) Firewall Manager: an API token.

REST API access on FMC is enabled by default. If it has been disabled, it can be re-enabled under System -> Configuration -> REST API Preferences.

Network as Code for FMC Module

The Network as Code Terraform module for FMC is responsible for mapping the data to the corresponding FMC resources. This module supports an inventory driven approach, where a complete FMC configuration or parts of it are modeled in one or more YAML files, organized under the same sections as the FMC Data Model: nac_configuration, existing, system, domains (with nested objects, policies, devices, vpns, and integrations).

The simple example repository is a good starting point for a single-resource deployment, while the configuration generator can produce more complex examples spanning the full data model.

Additional services

Cisco Customer Experience (CX) is able to help you with many additional services such as CI/CD integration, pre-change validation, integration with Information Technology Service Management (ITSM), as well as automated testing. Please reach out to your Cisco account team for more information.