Cisco Defense Orchestrator (CDO) is now the platform for the cloud-delivered
Firewall Management Center.
The cloud-delivered Firewall Management Center is a
software-as-a-service (SaaS) product that manages Secure Firewall Threat Defense
devices. It offers many of the same functions as an on-premises Secure Firewall
Management Center, it has the same appearance and behavior as an on-premises
Secure Firewall Management Center, and uses the same FMC API.
This product is designed for Secure Firewall Management Center customers who want
to move from an on-premises version of the Secure Firewall Management Center to
a SaaS version.
As a SaaS product, the CDO operations team is responsible for maintaining it. As
new features are introduced, the CDO operations team updates CDO and the
cloud-delivered Firewall Manager for you.
A migration wizard is available to help you migrate
your Secure Firewall Threat Defense devices registered to your on-premises
Secure Firewall Management Center to the cloud-delivered Firewall Management
Center.
Onboarding Secure Firewall Threat Defense devices is
carried out in CDO using familiar processes such as onboarding a device with its
serial number or using a CLI command that includes a registration key. Once the
device is onboarded, it is visible in both CDO and in the cloud-delivered
Firewall Management Center, however, you configure the device in the
cloud-delivered Firewall Management Center. Secure Firewall Threat Defense
devices running Version 7.2 or later can be onboarded.
The license for cloud-delivered Firewall Management Center is a
per-device-managed license and there is no license required for the cloud
delivered FMC itself. Existing Secure Firewall Threat Defense devices re-use
their existing smart licenses and new Secure Firewall Threat Defense devices
provision new smart licenses for each feature implemented on the FTD.
In a remote branch office deployment, the data interface of the threat defense
device is used for Cisco Defense Orchestrator management instead of the
Management interface on the device. Because most remote branch offices only have
a single internet connection, outside CDO access makes centralized management
possible. In the case of remote branch deployment, CDO provides high
availability support for the threat defense devices that it manages through
the data interface.
You can analyze syslog events generated by your onboarded threat defense devices
using Security Analytics and Logging (SaaS) or Security Analytics
and Logging (On Premises). The SaaS version stores events in the
cloud and you view the events in CDO. The on-premises version stores events in
an on-premises Secure Network Analytics appliance and analysis is done in the
on-premises Secure Firewall Management Center. In both cases, just as with an
on-premises FMC today, you can still send logs to a log collector of your choice
directly from the sensors.
The FTD dashboard provides you an at-a-glance view of
the status, including events data collected and generated by all threat defense
devices managed by the cloud-delivered Firewall Management Center. You can use
this dashboard to view collective information that is related to the device
status and the overall health of the devices in your deployment. The information
that the FTD dashboard provides depends on how you license, configure, and
deploy the devices in your system. The FTD dashboard displays data for all
CDO-managed threat defense devices. However, you can choose to filter
device-based data. You can also choose the time range to display for specific
time range.
The Cisco Secure Dynamic Attributes Connector enables
you to use service tags and categories from various cloud service platforms in
cloud-delivered Firewall Management Center access control rules. Network
constructs such as IP addresses may be ephemeral in virtual, cloud and container
environments due to the dynamic nature of the workloads and the inevitability of
IP address overlap. Customers require policy rules to be defined based on
non-network constructs such as VM name or security group, so that firewall
policy is persistent even when the IP address or VLAN changes.
Proxy sequences of one or more managed devices can be used to communicate with an LDAP, Active Directory, or ISE/ISE-PIC servers. It is necessary
only if Cisco Defense Orchestrator (CDO) cannot communicate with your Active Directory or ISE/ISE-PIC server. For example,
CDO might be in a public cloud but Active Directory or ISE/ISE-PIC might be in a private cloud.
Although you can use one managed device as a proxy sequence, we strongly
recommend you set up two or more so that, in the event one managed device cannot
communicate with Active Directory or ISE/ISE-PIC, another managed device can
take over.
Any customer can use CDO to manage other device types like, the Secure Firewall ASA, Meraki, Cisco IOS devices, Umbrella, and AWS virtual private
clouds. If you use CDO to manage a Secure Firewall Threat Defense device configured for local management with Firepower Device Manager,
you can continue to manage them with CDO as well. If you are new to CDO, you can manage Secure Firewall Threat Defense devices
with the new cloud-delivered Firewall Management Center and all of the other device types as well.
Learn more about the Firewall Management Center features we support in the
cloud-delivered Firewall Management Center.
Feedback