Onboard a Threat Defense Device

Onboard a Threat Defense Device to Cloud-delivered Firewall Management Center

You can onboard threat defense devices running version 7.2 and later to the Cloud-delivered Firewall Management Center. See Onboard an FTD to the Cloud-Delivered Firewall Management Center for more information.

Onboard a Threat Defense Device with a Serial Number

This procedure is a simplified method of onboarding the Firepower 1000, Firepower 2100, or Secure Firewall 3100 series physical devices running supported versions of software. To onboard the device, you need the chassis serial number or PCA serial number of the device and ensure that the device is added to a network that can reach the internet.

You can onboard new factory-shipped devices or already configured devices to CDO.

See Onboard an FDM-Managed Device using the Device's Serial Number for more information.

Onboard a Threat Defense Device with a Registration Key

We recommend onboarding threat defense devices with a registration key. This is beneficial if your device is assigned an IP address using DHCP. If that IP address changes for some reason, your threat defense device remains connected to CDO if you have onboarded it with a registration key.

• Onboard an FDM-Managed Device Running Software Version 6.4 or 6.5 Using a Registration Key

• Onboard an FDM-Managed Device Running Software Version 6.6+ Using a Registration Key

Onboard an Threat Defense Device Using Credentials

You can onboard a threat defense device using the device credentials and the IP address of the device's outside, inside, or management interface depending on how the device is configured in your network. To onboard a device with credentials, see Onboard an FDM-Managed Device Using Username, Password, and IP Address. To onboard with an interface address, see Device Addressing later in this article.

CDO needs HTTPS access to the device in order to manage it. How you allow HTTPS access to the device depends on how your device is configured in your network and whether you onboard the device using a Secure Device Connector or a Cloud Connector.

When using device credentials to connect CDO to a device, it a best practice to download and deploy a Secure Device Connector (SDC) in your network to manage the communication between CDO and the device. Typically, these devices are non-perimeter based, do not have a public IP address, or have an open port to the outside interface. The threat defense device, when onboarded with credentials, can be onboarded to CDO using an SDC.

Note that customers also using the threat defense devie as the head-end for VPN connections will not be able to use the outside interface to manage their device.

Onboard a Threat Defense Cluster

You can onboard a threat defense device that is clustered prior to onboarding to CDO. Clustering lets you group multiple firewall threat defense units together as a single logical device that provides the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices.

See Onboard a Clustered Secure Firewall Threat Defense Device.

FDM-Managed Device Configuration Prerequisites for Onboarding

FDM-Managed Device Management

You can only onboard threat defense devices that are being managed by Secure Firewall device manager (FDM). threat defense devices being managed by Secure Firewall Management Center cannot be managed by the cloud-delivered Firewall Management Center.

If the device is not configured for local management, you must switch to local management before onboarding the device. See the Switching Between Local and Remote Management chapter of the Secure Firewall Threat Defense Configuration Guide for Firepower Device Manager.

Licensing

The device must have at least an essentials license installed before it can be onboarded to CDO although you can have a Smart License applied in some circumstances.

See Cisco Firepower System Feature Licenses for more information.

Device Addressing

It is a best practice that the address you use to onboard the FDM-managed device is a static address. If the device's IP address is assigned by DHCP, it would be optimal to use a DDNS (dynamic domain name system) to automatically update your device's domain name entry with the new IP address of the device if it changes.