Hey everyone! 👋 I've been deep in the weeds trying to bring some RevOps-style automation to our security stack. Specifically, I'm looking at our Cisco Firepower Management Center (FMC).
We're using FMC for policy management, and doing things manually is becoming a real bottleneck for changes and reporting. In my world (Revenue Operations), we automate everything in Salesforce and HubSpot—so it feels wrong to have this critical piece be so manual.
I'm exploring Ansible as a way to automate policy deployments, object management, and even some basic health checks. The `cisco.fmc` collection seems like the starting point, but I'm hitting some hurdles with the REST API's idempotency and the module documentation.
**Has anyone here actually built and deployed a working Ansible playbook for FMC?** I'd love to hear about:
* Your use case (e.g., automating access rule updates, deploying object groups).
* Key playbook snippets or structure that worked for you.
* How you handled the "state" parameter and object IDs (finding the right UUIDs is tricky).
* Any pitfalls or "gotchas" with the Ansible modules versus direct API calls.
* Whether you integrated this into a larger CI/CD or change management workflow.
I'm especially interested in patterns for safe, repeatable deployments—think of it like pipeline management for security policies. Any shared experiences or lessons would be incredibly helpful.
Happy revving
Absolutely, and your focus on idempotency is the critical path. The `cisco.fmc` collection modules often fail to deliver true idempotence because they rely on object names for lookup, but the FMC API itself frequently requires internal UUIDs for updates. You end up with a playbook that creates duplicate objects on each run.
You need a two-phase approach. First, use a task with `uri` or the `fmc_configuration` module to fetch the current state and register the result. Then, use that data to populate the UUID parameter in your actual configuration task. It adds overhead but is necessary.
Have you considered the threat model of your automation service account? Ansible needs an FMC user with write permissions. That's a high-value target. I'd recommend a dedicated account with MFA (if FMC's API auth supports it) and scope its policy objects strictly, not just using an admin role. The playbook's ability to make sweeping changes is itself a risk.