About CDO Licenses

CDO requires a base subscription for tenant entitlement and device licenses for managing devices. You can buy one or more CDO base subscriptions based on the number of tenants you require and device licenses based on the device model number and the quantity. In other words, purchasing the base subscription gives you a CDO tenant, and for every device you choose to manage using CDO, you need separate device licenses.

To onboard and manage devices from Cisco Defense Orchestrator, you need to purchase a base subscription and device-specific, term-based subscriptions based on the devices you want to manage.


Cisco Defense Orchestrator subscriptions are term-based:

  • Base - Offers subscriptions for one, three, and five years, and provides entitlement to access the CDO tenant and onboard adequately licensed devices.

  • Device License - Offers subscriptions for one, three, and five years for any supported device you choose to manage. For example, you can choose to manage a Cisco Firepower 1010 device using CDO for three years, if you purchase a three-year software subscription to the Cisco Firepower 1010 device.

See Software and Hardware Supported by CDO for more information on Cisco security devices that CDO supports.


You do not require two separate device licenses to manage a high availabilty device pair in CDO. If you have a Secure Firewall ASA (ASA)orSecure Firewall Threat Defense (FTD) high availability pair, purchasing one ASAorFTD device license is sufficient, as CDO considers the pair of high availability devices as one single device.


You cannot manage CDO licensing through the Cisco smart licensing portal.

Software Subscription Support

The CDO base subscription includes software subcription support that is valid for the term of the subscription and provides access to software updates, major upgrades, and Cisco Technical Assistance Center (TAC), at no extra cost. While the software support is selected by default, you can also leverage the CDO solution support based on your requirement.

Cisco Defense Orchestrator Evaluation License

You can request for a 30-day Cisco Defense Orchestrator trial from your SecureX account. See Request a CDO Tenant for more information.