Onboard the Serial Number of a FDM-Managed Device for Low-Touch Provisioning

Caution: When the FDM-managed device is being onboarded in CDO, we recommend that you not perform the device easy setup using the Firepower Device Manager. This causes provisional error in CDO.

We recommend that you onboard the device to CDO using its serial number before the devices are powered on and connected to your branch networks.


Step 1

If you are onboarding a device purchased from an external vendor, you must reimage the device first. For more information, see the "Reimage Procedures" chapter of the https://www.cisco.com/c/en/us/td/docs/security/firepower/2100/troubleshoot_fxos/b_2100_CLI_Troubleshoot.html guide.

Step 2

Log in to CDO.

Step 3

In the navigation pane, click Inventory and click the blue plus button to Onboard a device.

Step 4

Click on FTD.


When you attempt to onboard an FDM-managed device, CDO prompts you to read and accept the End User License Agreement (EULA), which is a one-time activity in your tenant. Once you accept this agreement, CDO doesn't prompt it again in subsequent onboarding. If the EULA agreement changes in the future, you must accept it again when prompted.

Step 5

On the Onboard FTD Device screen, click Use Serial Number.

Step 6

In the Connection step, provide the following details and click Next.

What to do next

CDO starts claiming the device, and you will see the Claiming message on the right. CDO continuously polls for an hour to determine if the device is online and registered to the cloud. Once it's registered to the cloud, CDO starts the initial provisioning and onboards the device successfully. The device registration can be confirmed when the LED status flashes green on the device. If the device can't connect to the Cisco cloud or lose its connectivity after being connected, you can see the Status LED (Firepower 1000) or SYS LED (Firepower 2100) flashing alternate green and amber.

If the device is still not registered to the cloud within the first one hour, a time-out occurs, and now CDO polls periodically for every 10 minutes to determine the device status and remain in Claiming state. When the device is turned on and connected to the cloud, you don't have to wait for 10 minutes to know its onboarding status. You can click the Check Status link anytime to see the status. CDO starts the initial provisioning and onboards the device successfully.


Suppose you have already completed the device setup wizard (see Onboard an Already Configured FDM-Managed Device), the device is unregistered from the cloud, and in this case, CDO remains in Claiming state. You need to complete manual registration from Firepower Device Manager to add it to CDO. (In Firepower Device Manager, go to System Settings > Cloud Services and select the Auto-enroll with Tenancy from Cisco Defense Orchestrator option and click Register). Then, click Check Status.