Onboard a Device with a CLI Registration Key
Use the procedure below to onboard a device for cloud-delivered Firewall Management Center with a CLI registration key.
Note | If your device is currently managed by an on-prem management center, onboarding the device will fail. You can either delete the device from the on-prem management center and onboard as a fresh, new device with no policies or objects, or you can migrate the device and retain the existing policies and objects. See Migrate FTD from FMC to Cloud for more information. |
Before you begin
Before you onboard a device, be sure to complete the following tasks:
-
Cloud-Delivered Firewall Management Center is enabled for your tenant.
-
Confirm the device's CLI configuration is successfully completed. See Complete the Initial Configuration of a Secure Firewall Threat Defense Device Using the CLI for more information.
-
Review the prerequesites and limitations before you onboard the device. See "Prerequesites to Onboard a Device to Cloud-Delivered Firewall Management Center" in Managing Firewall Threat Defense with Cloud-Delivered Firewall Management Center in Cisco Defense Orchestrator for more information.
-
Device must be running version 7.0.3, or 7.2.0 and later.
Procedure
Step 1 | Log in to CDO. | ||
Step 2 | In the navigation pane, click Inventory and click the blue plus button. | ||
Step 3 | Select the FTD tile. | ||
Step 4 | Under Management Mode, be sure FTD is selected.
| ||
Step 5 | Select Use CLI Registration Key as the onboarding method. | ||
Step 6 | Enter the device name in the Device Name field and click Next. | ||
Step 7 | In the Policy Assignment step, use the drop-down menu to select an access control policy to deploy once the device is onboarded. If you have no policies configured, select the Default Access Control Policy. | ||
Step 8 | Specify whether the device you are onboarding is a physical or virtual device. If you are onboarding a virtual device, you must select the device's performance tier from the drop-down menu. | ||
Step 9 | Select the base licenses you want applied to the device. Click Next. | ||
Step 10 | CDO generates a command with the registration key. Paste the entire registration key as is into the device's CLI. Note: For Firepower 1000, Firepower 2100, ISA 3000, and FTDv devices, open an SSH connection to the device and log in as
| ||
Step 11 | Click Next in the CDO onboarding wizard. | ||
Step 12 | (Optional) Add labels to your device to help sort and filter the Inventory page. Enter a label and select the blue plus button. Labels are applied to the device after it's onboarded to CDO. |
What to do next
-
Create a custom access control policy to customize the security for your environment. See the Access Control Policies chapter for more information.
-
Enable Cisco Security Analytics and Logging (SAL) to view events in the CDO dashboard or register the device to an Firepower Management Center for security analytics. See the Cisco Security Analytics and Logging chapter for more information.