Connect Cisco Defense Orchestrator to the Cloud SDC
CDO communicates with most managed devices and services through the SDC. If your SDC is deployed in the cloud, the devices that CDO manages must allow inbound access on port 443 (or whichever port you have configured for your device management) from various IP addresses in the EMEA, United States, or APJC region.
If you are a customer in Europe, the Middle East, or Africa (EMEA), and you connect to Defense Orchestrator at https://defenseorchestrator.eu, allow inbound access from the following IP addresses:
If you are a customer in the United States, and you connect to Defense Orchestrator at https://defenseorchestrator.com, allow inbound access from the following IP addresses:
If you are a customer in the Asia-Pacific-Japan-China (APJC) region, and you connect to Defense Orchestrator at https://www.apj.cdo.cisco.com/, allow inbound access from the following IP addresses:
Connect Cisco Defense Orchestrator to the On-premises SDC
If your SDC is deployed on-premises, the devices CDO manages must allow full inbound access on port 443 (or whichever port you have configured for your device management). This is configured using a management access control rule.
You must also ensure that the virtual appliance running SDC has network connectivity to the management interface of the managed device.
Special Considerations for Connecting an ASA to an SDC
Specifically, for ASA, the SDC uses the same secure communications channel used by ASDM.
If the ASA under management is also configured to accept AnyConnect VPN Client connections, the ASDM HTTP server port must be changed to a value of 1024 or higher. Note that this port number will be the same port number used when onboarding the ASA device to CDO.
Example ASA Commands
The following examples assume that the ASA outside interface is named 'outside' and an AnyConnect client is configured on the ASA, so the ASDM HTTP server is listening on port 8443.
To enable the outside interface, enter these commands:
http 126.96.36.199 255.255.255.255 outside
http 188.8.131.52 255.255.255.255 outside
http 184.108.40.206 255.255.255.255 outside
http 220.127.116.11 255.255.255.255 outside
https 18.104.22.168 255.255.255.255 outside
https 22.214.171.124 255.255.255.255 outside
To enable the ASDM HTTP server port, in the case where AnyConnect VPN Client is in use, enter this commands:
http server enable 8443