Skip to main content

 

 

Cisco Defense Orchestrator

Frequently Asked Questions

Cisco Defense Orchestrator

  • What is the Cisco© Defense Orchestrator?
    • The Cisco Defense Orchestrator (CDO) is a cloud-based platform that helps network operations staff establish and maintain an end-to-end security posture by managing security policies across Cisco security devices. It analyzes security policy configuration for Cisco Adaptive Security Appliances (ASA), Cisco ASA with FirePOWERTM Services, Cisco Firepower Next-Generation Firewalls (NGFW), and Cisco Umbrella to identify and resolve policy inconsistencies, model policy changes to validate their impact, and orchestrate policy changes to achieve consistency and maintain clarity in security posture.

Security

  • Is CDO Secure?
    • CDO offers end-to-end security for customer data through the following features:
      • Two-Factor Authentication
      • Authentication calls for APIs and database operations
      • Data isolation in flight and at rest
      • Separation of roles

CDO requires multi-factor authentication for users to connect to their cloud portal. Multi-factor authentication is a vital function needed to protect the identity of customers. 

All data, in flight and at rest, is encrypted. Communication from devices on customer premises and CDO is encrypted with SSL, and all customer-tenant data volumes are encrypted.

CDO's multi-tenant architecture isolates tenant data and encrypts traffic between databases and application servers. When users authenticate to gain access to CDO, they receive a token. This token is used to fetch a key from a key-management service, and the key is used to encrypt traffic to the database.

CDO provides value to customers quickly while making sure customer credentials are secured. This is achieved by deploying a "Secure Data Connector" in the cloud or a customer's own network (in roadmap) that controls all inbound and outbound traffic to make sure the credential data doesn't leave the customer premises.

  • I received the error "Could not validate your OTP" when logging into CDO for the first time
    • Check that your desktop or mobile device clock is synchronized with a world time server. Clocks being out of sync by less or more than a minute can cause incorrect OTPs to be generated.
  • I have a new cell phone and need to replace my 2FA authenticator, what should I do?
  • Should I create dedicated CDO accounts on my devices?
    • Yes. It is recommended that new accounts be created for CDO access rather than reuse existing admin accounts.
  • It has been more than 24 hours since I received my invitation to create a CDO account, what should I do?
  • Is my device connected directly to Cisco Defense Orchestrator cloud platform?

    • Yes. The secured connection is performed using the CDO SDC which is used as a proxy between the device and CDO platform. CDO architecture, designed with security first in mind, enables having complete separation between data traversing back and forth to the device.

  • How can I connect a device which does not have a public IP address?

    • You can leverage CDO On-Premises Secure Device Connector which can be deployed within your data center and doesn’t need any outside port to be open. Once the On-premises SDC is deployed you can onboard devices with internal (non-internet routable) IP addresses.

  • Is using the On-Premises Secure Device Connector require any additional cost or license?

    • No.

  • Are there any performance limitation with using either the cloud or on-premises Secure Device Connector?

    • No. both the cloud and on-premises SDCs uses the same code base and one should not have any limitation over the other.

  • What types of Virtual Private Network are currently supported with CDO?

    • CDO supports IPsec Site-to-Site VPN tunnel management only. Stay tuned for updates to our What’s New page!

  • How can I check the tunnel status? State options

    • CDO performs the tunnel connectivity checks automatically every hour, however ad-hoc VPN tunnel connectivity checks can be performed by choosing a tunnel and requesting to check connectivity. Results may take several seconds to process.

  • Can I search a tunnel based on the device name as well as its IP address of one of its peers?

    • Yes. Search and pivot to a specific VPN tunnel details by using available filters and search capabilities on both name and the peers IP addresses

Policy Optimization

  • How can I identify a case when two or more access lists (within the same access group) are shadowing each other?
    • Cisco Defense Orchestrator Network Policy Management (NPM) is able to identify and alert the user if within a rule set, a rule higher in order, is shadowing a different rule. User can either navigate between all network policies or filter to identify all shadow issues. For more information, see Network Policy Management.

Note: Cisco Defense Orchestrator supports only fully shadowed rules.

Connectivity

  • What is required to connect my devices to the CDO Cloud Based Secure Device Connector?
    • ASDM image present and enabled
    • Public interface access to 52.25.109.29, 52.34.234.2, 52.36.70.147
    • ASA's HTTPS port must be set to 443 or to a value of 1024 or higher. For example, it cannot be set to port 636.
    • If the ASA under management is also configured to accept AnyConnect VPN Client connections, the ASA HTTPS port must be changed to a value of 1024 or higher.
  • What are the prerequisites for on-boarding a FirePOWER device?
  • What are the prerequisites for on-boarding Cisco Umbrella policy?
    • If you are using Cisco Umbrella Two-Step Verification, create a new dedicated account for CDO with a long, randomly generated password and without two-step verification login security for access to CDO. CDO uses provided credentials for all read and write operations as well as out-of-band changes polling.
  • The Secure Device Connector changed IP address, but this was not reflected within CDO. What can I do to reflect the change?
    • In order to obtain and update the new Secure Device Connector (SDC) within CDO, you will need to restart the container using the following commands
      Stop Docker deamon > #service docker  stop
      Change IP address
      Start Docker deamon > #service docker start
      Restart container on the SDC virtual appliance > bash-4.2$ ./cdo/toolkit/toolkit.sh restartSDC <tenant-name>

Troubleshooting

  • While performing complete write of device configuration from CDO to managed device, I get a warning “Cannot write changes to device”. What can I do to solve that?
    • In case an error occurred during writing full configuration (changes performed beyond CDO supported commands) to the device, majority of the time, simple “Read” of latest available configuration from device will solve the problem and you will be able to continue making changes on CDO and write them. In case issue persist, please email CDO Support at cdo.support@cisco.com.

  • While resolving out-of-band issue (changes performed outside of CDO; directly to a device), comparing the configuration present in CDO that of the device, CDO presents additional metadata that were not added or modified by me. Why?

    • As CDO expands its functionality,  additional information will be collected from the device’s configuration to enrich and maintain all required data for better policy and device management analysis. These are not changes that occurred on managed device but already existing information. Resolving the conflict detected state can be easily solved by reading from the device and reviewing all detailed changes occurred.

  • CDO is rejecting my cerificate. What can I do about it? 

Devices

  • What is an Adaptive Security Appliance (ASA)?
    • The Cisco ASA provides advanced stateful firewall and VPN concentrator functionality in one device as well as integrated services with add-on modules. The ASA includes many advanced features, such as multiple security contexts (similar to virtualized firewalls), clustering (combining multiple firewalls into a single firewall), transparent (Layer 2) firewall or routed (Layer 3) firewall operation, advanced inspection engines, IPsec VPN, SSL VPN, and clientless SSL VPN support, and many more features. ASAs can be installed on virtual machines or supported hardware.
  • What is an ASA FirePOWER module?
    • The ASA FirePOWER module runs as a separate application from the ASA and supplies next-generation firewall services, including Next-Generation Intrusion Prevention System (NGIPS), Application Visibility and Control (AVC), URL filtering, and Advanced Malware Protection (AMP). You can use the module in single or multiple context mode, and in routed or transparent mode. CDO identifies the ASA FirePOWER module as a FirePOWER type device. This is not the same as FTD.
    What is Firepower Threat Defense (FTD)
    • Cisco's next generation firewall software image. It strives to combine the best of Sourcefire next generation firewall services and the ASA platform. It can be installed on a number of different Firepower hardware devices or virtual machines. This is not the same as a ASA FirePOWER module. These devices are not yet supported on CDO. See ASA Software and Hardware Support for more information.
  • What is Firepower Device Manager (FDM)
    • Firepower Device Manager is Firepower Threat Defense management software delivered with the FTD image. FDM is designed to manage the one FTD it is delivered with. You may also hear FDM referred to as the "on-box" manager.  
  • What is Firepower?
    • Firepower is a general term that refers to a group of next generation firewall hardware and software. 
  • When is a device Synced?
    • When the configuration on CDO and the configuration stored locally on the device are the same.  
  • When is a device Not Synced? 
    • When the configuration stored in CDO was changed and it is now different that the configuration stored locally on the device.
  • When is a device in a Conflict Detected state? 
    • When the configuration on the device was changed outside of CDO (out-of-band), and is now different than the configuration stored on CDO.
  • What is an out-of-band change?
    • When a change is made to the device outside of CDO. The change is made directly on the device using CLI command or by using the on-device manager such as ASDM or FDM. An out-of-band change causes CDO to report a "Conflict Detected" state for the device. 
  • What ASA commands are currently supported?
    • access-list
    • object-group
    • object
  • Are there any scale limitations for device management?
    • CDO's cloud architecture allows it to scale to thousands of devices.
  • Does CDO manage Cisco Integrated Services Routers and Aggregation Services Routers?
    • CDO allows you to create a model device for ISRs and ASRs and import its configuration. You can then create templates based on the imported configurations and export the configuration as a standardized configuration that can be deployed to new or existing ISR and ASR devices for consistent security.
  • Can CDO work with SMA?
    • CDO cannot currently work with the SMA.

If you cannot find the answers to your questions here, please contact cdo.support@cisco.com