Integrate an On-Premises Firewall Management Center With Cisco Security Cloud

Login

Cisco Security Cloud Control: On-Premises Firewall Management Center Integration

Introduction
- Overview of Cisco Security Cloud Control
- Products and Solutions Supported by Security Cloud Control
- Overview of Security Cloud Control Firewall Management
- Manage On-Premises Firewall Management Center with Security Cloud Control
- The Firewall Management dashboard
Configure Basic Settings
- Create a Security Cloud Control Tenant
- Security Cloud Control Firewall Management dashboard
- Create a Security Cloud Control Tenant
- Security Cloud Control Firewall Management dashboard
- Login Requirements for Security Cloud Control
  - Initial Login to Your New Security Cloud Control Tenant
  - Signing in to Security Cloud Control in Different Regions
  - Troubleshooting Login Failures
- Migrate to Cisco Security Cloud Sign On Identity Provider
  - Troubleshooting Login Failures after Migration
- Launch a Security Cloud Control Tenant
- Security Cloud Control Firewall Management Integrations Page
- Security Cloud Control Firewall Management licenses
  - Cloud-Delivered Firewall Management Center licensing and registration
- Security Cloud Control Firewall Management Platform Maintenance Schedule
- Cloud-Delivered Firewall Management Center Maintenance Schedule
- Introduction to Objects
  - Object Types
  - Shared Objects
  - Object Overrides
  - Unassociated Objects
  - Compare Objects
  - Filters
    - Object Filters
      - Configure Object Filters
      - When to Exclude a Device from Filter Criteria
  - Unignore Objects
  - Deleting Objects
    - Delete a Single Object
    - Delete a Group of Unused Objects
  - Network Objects
    - Create or Edit ASA Network Objects and Network Groups
      - Create an ASA Network Object
      - Create an ASA Network Group
      - Edit an ASA Network Object
      - Edit an ASA Network Group
      - Add Additional Values to a Shared Network Group in Security Cloud Control
      - Edit Additional Values in a Shared Network Group in Security Cloud Control
      - Deleting Network Objects and Groups in Security Cloud Control
    - Create or Edit a Firepower Network Object or Network Groups
      - Create a Firepower Network Object
      - Create a Firepower Network Group
      - Edit a Firepower Network Object
      - Edit a Firepower Network Group
      - Add an Object Override
      - Edit Object Overrides
      - Add Additional Values to a Shared Network Group
      - Edit Additional Values in a Shared Network Group
      - Deleting Network Objects and Groups in Security Cloud Control
    - Discover and manage On-Premises Firewall Management Center network objects
  - Service Objects
- Network Address Translation
- Order of Processing NAT Rules
- Network Address Translation Wizard
  - Create a NAT Rule by using the NAT Wizard
- Common Use Cases for NAT
  - Enable a Server on the Inside Network to Reach the Internet Using a Public IP address
  - Enable Users on the Inside Network to Access the Internet Using the Outside Interface's Public IP Address
  - Make a Server on the Inside Network Available on a Specific Port of a Public IP Address
    - NAT Incoming FTP Traffic to an FTP Server
    - NAT Incoming HTTP Traffic to an HTTP Server
    - NAT Incoming SMTP Traffic to an SMTP Server
  - Translate a Range of Private IP Addresses to a Range of Public IP Addresses
    - Translate a Pool of Inside Addresses to a Pool of Outside Addresses
  - Prevent a Range of IP Addresses from Being Translated When Traversing the Outside Interface
    - Create a Twice NAT Rule
Manage Tenants and Users
- Manage a Security Cloud Control Tenant
  - Configure User Preferences
    - General Preferences
      - Change the Security Cloud Control Web Interface Appearance
    - Manage user notification preferences
    - View Security Cloud Control Notifications
  - Configure general settings
    - Enable Change Request Tracking
    - Enable the option to auto-accept device changes
    - Set the default conflict detection interval
    - Manage web analytics
    - Enable event data sharing with Talos
    - View firewall management instance details
    - Tenant Name
    - Use the Security Cloud Control Firewall Management platform navigator
  - Organization Notification Settings
    - Enable Email Subscribers
      - Add an Email Subscription
      - Edit Email Subscriptions
      - Delete an Email Subscription
    - Enable Service Integrations for Security Cloud Control Notifications
      - Incoming Webhooks for Webex Teams
      - Incoming Webhooks for Microsoft Teams
      - Incoming Webhooks for Slack
      - Incoming Webhooks for a Custom Integration
  - View logging settings
  - Integrate Your SAML Single Sign-On with Security Cloud Control
  - Renew SSO Certificate
  - My Tokens
  - API Tokens
    - API Token Format and Claims
    - Manage API-only Users for Security Cloud Control
    - Token Management
      - Create API Only Users
      - Generate an API Token
      - Refresh an API Token
      - Revoke an API Token
  - Relationship Between the Identity Provider Accounts and Security Cloud Control User Records
    - Login Workflow
    - Implications of this Architecture
      - Customers Who Use Cisco Security Cloud Sign On
      - Customers Who Have Their Own Identity Provider
      - Cisco Managed Service Providers
      - Related Topics
  - MSSP Portal
    - Security Devices Details
    - Add a Tenant to the MSSP Portal
    - Delete a Tenant from the MSSP Portal
    - Overview of Smart Licensing Dashboard
      - View Smart Licensing Dashboard
    - About multitenant device upgrades in MSSP portal
      - Initiate a full multitenant device upgrade in MSSP portal
      - Initiate a staged multitenant device upgrade in MSSP portal
      - Perform bulk upgrade from Security Devices page in MSSP portal
    - Manage MSSP Portal Settings
      - Settings
        
        General Settings
        
        User Management
      - Switch Tenant
  - The Cisco Success Network
- Manage Users in Security Cloud Control
  - Manage Super Admins on Your Tenant
  - View the API User Records Associated with your Tenant
- Active Directory Groups in User Management
  - Prerequisites for Adding an Active Directory Group to Security Cloud Control
  - Add an Active Directory Group for User Management
  - Edit an Active Directory Group for User Management
  - Delete an Active Directory Group for User Management
- Create a New Security Cloud Control User
  - Create a Cisco Security Cloud Sign On Account for the New User
    - About Logging in to Security Cloud Control
    - Before You Log In
    - Create a New Cisco Security Cloud Sign On Account and Configure Duo Multi-factor Authentication
  - Create a User Record with Your Security Cloud Control Username
  - The New User Opens Security Cloud Control from the Cisco Secure Sign-On Dashboard
- Understand user roles in Security Cloud Control Firewall Management
  - Read-only role
  - Edit-Only role
  - Deploy-Only role
  - VPN Sessions Manager role
  - Admin role
  - Super Admin role
  - Change The Record of the User Role
- Add a User Account to Security Cloud Control
  - Create a User Record
- Edit a User Record for a User Role
  - Edit a User Role
- Delete a User Record for a User Role
  - Delete a User Record
Connect Your Device
- About Secure Device Connector
  - Plan device connectivity
    - Allow inbound access for direct cloud connectivity
  - Plan SDC capacity and host requirements
  - Deploy a VM for Running the Secure Device Connector and Secure Event Connector
  - Deploy a Secure Device Connector On Your VM
  - Bootstrap a Secure Device Connector on the Deployed Host
  - Deploy a Secure Device Connector to vSphere Using Terraform
  - Deploy a Secure Device Connector on an AWS VPC Using a Terraform Module
  - Migrate an On-Premises Secure Device Connector and Secure Event Connector from a CentOS 7 Virtual Machine to an Ubuntu Virtual Machine
  - Change the IP Address of a Secure Device Connector
  - Move an ASA from one Secure Device Connector to Another
  - Rename a Secure Device Connector
  - Update a Secure Device Connector manually
  - Use multiple Secure Device Connectors on one organization
  - Find devices that sse the same Secure Device Connector
  - Remove a Secure Device Connector
  - Open Source and Third-Party License in SDC
Device Onboarding in Security Cloud Control
- Supported Devices, Software, and Hardware for Security Cloud Control Firewall Management
- Onboard an On-Premises Firewall Management Center to Security Cloud Control
  - Auto onboard an On-Premises Firewall Management Center integrated with Cisco Security Cloud
    - Integrate an On-Premises Firewall Management Center With Cisco Security Cloud
    - Auto onboard On-Prem FMCs from Cisco Security Cloud
  - Onboard an On-Premises Firewall Management Center to Security Cloud Control with Credentials
  - Redirect Security Cloud Control to an On-Premises Firewall Management Center
- Remove an On-Premises Firewall Management Center from Security Cloud Control
Manage Onboarded Device Settings
- Changing a Device's IP Address in Security Cloud Control
- Changing a Device's Name in Security Cloud Control
- Export a List of Devices and Services
- Export Device Configuration
- External Links for Devices
  - Create an External Link from your Device
  - Create an External Link to
  - Create an External Link for Multiple Devices
  - Edit or Delete External Links
  - Edit or Delete External Links for Multiple Devices
- Bulk Reconnect Devices to Security Cloud Control
- Moving Devices Between Tenants
- Device Certificate Expiry Detection
- Write a Device Note
- Delete a Device from Security Cloud Control
- Manage Security Devices
- Back Up Firewall Threat Defense Devices Managed by Security Cloud Control
- Manage Firewall Threat Defense Devices Through Security Cloud Control
- Security Devices Overview
- Security Cloud Control Labels and Filtering
  - Apply Labels to Devices and Objects
  - Filters
- Use Security Cloud Control Search Functionality
  - Page Level Search
  - Global Search
    - Initiate Full Indexing
    - Perform a Global Search
Configuring On-Premises Firewall Management Center Devices
- View onboarded On-Premises Firewall Management Center
- Troubleshoot cloud region synchronization issue in On-Premises Firewall Management Center high availability
- Discover and manage On-Premises Firewall Management Center network objects
- Reading, Discarding, and Deploying Configuration Changes
  - Read All Device Configurations
  - Preview and Deploy Configuration Changes for All Devices
  - Bulk Deploy Device Configurations
  - Preview and deploy On-Premises Firewall Management Center configurations
  - Discard Configuration Changes
  - Discard On-Premises Firewall Management Center configuration changes
  - Out-of-Band Changes on Devices
- Synchronizing Configurations Between Security Cloud Control and Device
  - Conflict Detection
    - Enable Conflict Detection
    - Enable conflict detection for an On-Premises Firewall Management Center
  - Automatically Accept Out-of-Band Changes from your Device
    - Configure Auto-Accept Changes
    - Disabling Auto-Accept Changes for All Devices on the Tenant
  - Resolve Configuration Conflicts
    - Resolve the Not Synced Status
    - Resolve the Conflict Detected Status
  - Schedule Polling for Device Changes
Policy Analyzer and Optimizer
- About Policy Analyzer and Optimizer
  - Analysis, Remediation, and Reporting
- Prerequisites to Use Policy Analyzer and Optimizer
- Policy Analyzer and Optimizer Licensing Requirements
- Enable Policy Analyzer and Optimizer for Cloud-Delivered Firewall Management Center
- Enable Policy Analyzer and Optimizer for Security Cloud Control-managed On-Premises Firewall Management Center
- Policy Analysis
  - Analyze Cloud-Delivered Firewall Management Center Policies
  - Analyze On-Premises Firewall Management Center Policies
- Policy Reporting
  - Policy analysis summary
  - Duplicate Rules
  - Expired Rules
  - Mergeable Rules
  - Overlapping Objects
  - Policy insights
- Policy Remediation
  - Apply Policy Remediation
  - What Does the Policy Remediation Report Contain?
- Troubleshooting Policy Analyzer and Optimizer
  - Policy Analyzer and Optimizer Does Not Analyze Policies
  - Policy Analyzer and Optimizer Does Not Fetch Policies
- Frequently Asked Questions About Policy Analyzer and Optimizer
Manage Device Configuration
- Reading, Discarding, and Deploying Configuration Changes
  - Read All Device Configurations
  - Preview and Deploy Configuration Changes for All Devices
  - Bulk Deploy Device Configurations
  - Preview and deploy On-Premises Firewall Management Center configurations
  - Discard Configuration Changes
  - Discard On-Premises Firewall Management Center configuration changes
  - Out-of-Band Changes on Devices
- Synchronizing Configurations Between Security Cloud Control and Device
  - Conflict Detection
    - Enable Conflict Detection
    - Enable conflict detection for an On-Premises Firewall Management Center
  - Automatically Accept Out-of-Band Changes from your Device
    - Configure Auto-Accept Changes
    - Disabling Auto-Accept Changes for All Devices on the Tenant
  - Resolve Configuration Conflicts
    - Resolve the Not Synced Status
    - Resolve the Conflict Detected Status
  - Schedule Polling for Device Changes
Monitor and Report Change Logs, Workflows, and Jobs
- Manage Change Logs in Security Cloud Control
- View Change Log Differences
- Change Request Management
  - Enable Change Request Management
  - Create a Change Request
  - Associate a Change Request with a Change Log Event
  - Search for Change Log Events with Change Requests
  - Search for a Change Request
  - Filter Change Requests
  - Clear the Change Request Toolbar
  - Clear a Change Request Associated with a Change Log Event
  - Delete a Change Request
  - Disable Change Request Management
  - Change Request Management Use Cases
- Export the Change Log
  - Differences Between Change Log Capacity in Security Cloud Control and Size of an Exported Change Log
- Monitor Workflows in Security Cloud Control
Integrating Security Cloud Control with Cisco Security Cloud Sign On
- Merge Your Security Cloud Control and Cisco XDR Tenant Accounts
Terraform
- About Terraform
Troubleshooting
- Troubleshoot a Secure Device Connector
  - SDC is Unreachable
  - SDC Status not Active on Security Cloud Control After Deployment
  - Changed IP Address of the SDC is not Reflected in Security Cloud Control
  - Troubleshoot Device Connectivity with the SDC
  - Intermittent or No Connectivity with SDC
  - Container Privilege Escalation Vulnerability Affecting Secure Device Connector: cisco-sa-20190215-runc
    - Updating a Security Cloud Control-Standard SDC Host
    - Updating a Custom SDC Host
    - Bug Tracking
  - Invalid System Time
  - SDC version is lower than 202311****
  - Certificate or Connection errors with AWS servers
- Troubleshoot Security Cloud Control
  - Troubleshooting Access and Certificates
    - Resolve New Fingerprint Detected State
    - Troubleshooting Network Problems Using Security and Analytics Logging Events
    - Troubleshooting SSL Decryption Issues
  - Troubleshooting Login Failures after Migration
  - Troubleshooting Objects
    - Resolve Duplicate Object Issues
    - Resolve Unused Object Issues
      - Resolve an Unused Object Issue
      - Remove Unused Objects in Bulk
    - Resolve Inconsistent Object Issues
    - Resolve Object Issues in Bulk
- Device Connectivity States
  - Troubleshoot Insufficient Licenses
  - Troubleshoot Invalid Credentials
  - Troubleshoot New Certificate Issues
    - New Certificate Detected
  - Troubleshoot Onboarding Error
  - Resolve the Conflict Detected Status
  - Resolve the Not Synced Status
  - Troubleshoot Unreachable Connection State
FAQ and Support
- Security Cloud Control
- FAQ About Onboarding Devices to Security Cloud Control
  - FAQs About Onboarding Secure Firewall ASA to Security Cloud Control
  - FAQs About Onboarding Secure Firewall Threat Defense to Cloud-Delivered Firewall Management Center
  - FAQs About on-premises Firewall Management Center
  - FAQs About Onboarding Meraki Devices to Security Cloud Control
  - FAQs About Onboarding SSH Devices to Security Cloud Control
  - FAQs About Onboarding IOS Devices to Security Cloud Control
- Device Types
- Security
- Troubleshooting
- Terminologies and Definitions used in Zero-Touch Provisioning
- Policy Optimization
- Connectivity
- About Data Interfaces
- How Security Cloud Control Processes Personal Information
- Contact Security Cloud Control Support
  - Export The Workflow
  - Open a Support Ticket with TAC
    - How Security Cloud Control Customers Open a Support Ticket with TAC
    - How Security Cloud Control Trial Customers Open a Support Ticket with TAC
  - Security Cloud Control Service Status Page

Device Onboarding in Security Cloud Control Onboard an On-Premises Firewall Management Center to Security Cloud Control Auto onboard an On-Premises Firewall Management Center integrated with Cisco Security Cloud Integrate an On-Premises Firewall Management Center With Cisco Security Cloud

Last updated: May 13, 2026

Previous topic Auto onboard an On-Premises Firewall Management Center integrated with Cisco Security Cloud Next topic Auto onboard On-Prem FMCs from Cisco Security Cloud