Device Pack

What Is a Device Pack?

A device pack is a FireMon-specific software package that lets a vendor device, such as a firewall, communicate with FireMon's Data Collector within Security Manager. It defines how FireMon reads, matches, and normalizes a device's configuration data, and FireMon updates device packs regularly as vendors change their software.

Key takeaways

• A device pack is a FireMon-specific .jar software package that connects a vendor device to FireMon's Data Collector.
• It defines the matching configuration FireMon uses to normalize a device's configuration and usage data.
• FireMon ships updated device packs with each software revision as vendors change their device software.
• Checking for an outdated device pack is one of the first troubleshooting steps for retrieval or normalization issues.

Why It Matters

Security teams rarely run just one firewall vendor. A typical environment mixes Palo Alto, Cisco, Fortinet, Juniper, and more, each with its own configuration format, CLI syntax, and object structure. For FireMon's Security Manager to make sense of all of it, it needs a translator for each device type. That translator is the device pack. Without an accurate, up-to-date device pack, Security Manager cannot reliably retrieve or interpret a device's rules, which directly affects how confidently a team can audit, report on, or manage change across that device.

How It Works

A device pack is a .jar file that contains the matching configuration FireMon uses for a specific vendor and product. That matching configuration contains one or more regular expressions and may include group mappings to specific fields, which are captured and used in downstream processing. When a device is created in Security Manager, this matching configuration is associated with the device in a field called extendedsettings, and the default matching configuration comes directly from the device pack's settings.

Device packs are listed on the Device Packs page in Security Manager (Device > Device Packs), where each entry shows the vendor, product, device type, and device pack version. Each FireMon software revision ships with updated device packs. If a specific device pack is not included in a given FMOS general availability (GA) release, FireMon Support can provide the .jar file directly, which an admin then uploads through the Device Packs page before creating or updating the device.

A Realistic Example

Say a team is onboarding a Cisco Firepower Management Center (FMC) into Security Manager. Before creating the device record, they confirm whether the needed device pack was included in their current FMOS GA release. If it was not, they contact FireMon Support, receive the .jar file, and upload it under Device > Device Packs. Only after that upload is complete do they create the FMC device and begin configuration retrieval.

The Operational Consequence

Vendors change their device software on their own schedule, and those changes can alter how configuration data is structured or exposed. If a device pack falls behind, the result is often a normalization or retrieval failure, meaning Security Manager cannot correctly interpret the data coming back from the device. This is significant enough that checking the device pack version is typically one of the first things FireMon Support looks at when troubleshooting a firewall with retrieval or normalization issues. An outdated device pack does not just create a technical error; it can mean incomplete or inaccurate rule data feeding into audits, reports, and change workflows.

Key Components and Best Practices

• Matching configuration: the regular expressions and field mappings that tell FireMon how to read a specific device's data.
• Device Pack Version: shown on the Device Packs page, this tells you exactly which version is running for a given vendor and product.
• extendedsettings field: where the device's matching configuration is stored once the device is created.
• Routine updates: device packs arrive with each FireMon software revision, so keeping Security Manager current keeps device packs current too.
• Manual upload path: for devices not yet covered by a GA release, FireMon Support provides the .jar file for upload.

Common Challenges

Teams managing many different vendors and device types can lose track of which device pack version is running where, especially across large, multi-vendor estates. It is also easy to overlook a device pack update when a vendor pushes a minor software change that is not obviously disruptive, only to discover normalization problems later. Knowing where to check device pack version information, and understanding that it is a frequent root cause of retrieval issues, saves troubleshooting time.

How This Connects to Network Security Policy Management and FireMon

Device packs are part of the plumbing that makes consistent policy management possible across a mixed-vendor environment. FireMon, the founder of NSPM, built the device pack framework into Security Manager so the platform can read, match, and normalize configuration data from many different vendors into one consistent view for policy governance, validation, and audit evidence. Policy is the control plane for network security, and device packs are part of what keeps that control plane accurate, no matter which vendor's hardware sits underneath it.