Onboard Cisco FTD Appliances to Security Cloud Control with cdFMC

Introduction#

This guide onboards two Cisco Secure Firewall Threat Defense (FTD) appliances to Cloud-Delivered Firewall Management Center (cdFMC) through Cisco Security Cloud Control (SCC). SCC provides the onboarding workflow and device inventory; cdFMC manages the firewall configuration and policies.

Both appliances started as fresh installations with local FDM management configured. The first uses a CLI Registration Key; the second uses Serial Number onboarding with auto-enrollment from FDM. Customer names, addresses, keys, and device identifiers are redacted.

Lab Environment#

Prerequisites#

• Access to the SCC tenant and permission to enable cdFMC and onboard devices.
• Access to each appliance's CLI and, for the serial-number method, its FDM interface.
• Initial management configuration completed, including the management address, gateway, DNS, and connectivity to Cisco cloud services.

Management change: The onboarding wizard warns that cdFMC takes over configuration management and existing policies are lost except for basic interface configuration. Prepare the policy to be assigned in cdFMC before onboarding an appliance that already carries traffic.

1. Enable cdFMC and Review Licensing#

In SCC, open Administration > Integrations > Firewall Management Center, then select Enable cdFMC. Allow provisioning to finish and confirm that its status changes to Active. The timeline allows approximately 15–30 minutes for provisioning.

Figure 1. cdFMC is active and ready for device onboarding.

Select the cdFMC entry and open Smart Licenses from its details panel. This lab uses evaluation licensing; the captured page shows 89 days remaining. Subscription features are selected during device onboarding.

2. Check the Appliance Before Onboarding#

Run these commands from the FTD CLI on each appliance:

Confirm the software version, management link, address, gateway, and DNS settings. Before onboarding, both captured sessions report:

If your session opens at the FXOS prompt, enter connect ftd to reach the FTD CLI.

3. Open the Onboarding Wizard#

In SCC, open Security Devices, select + / Onboard device or service, and choose FTD. Review and accept the license agreement when prompted.

The wizard offers CLI Registration Key, Serial Number, and bulk CSV onboarding. This guide uses the first two, on separate appliances.

Figure 2. Select the onboarding method for the appliance.

Method 1: CLI Registration Key#

Configure the Device in SCC

Select Use CLI Registration Key, then complete the wizard:

1. Enter a device name.
2. Assign Default Access Control Policy, as used in this lab.
3. Select Physical FTD Device and the required subscription features.
4. Continue to the CLI Registration Key step and copy the complete generated command.

Figure 3. SCC generates the registration command for the first appliance.

Apply the Generated Command on FTD

The captured command contains four values after configure manager add:

Use the complete command generated by your SCC wizard. Preserve all its values, including the NAT ID and manager display name.

The CLI warns that enabled FDM feature licenses must be disabled before removing the local manager, otherwise their assignments remain in Cisco Smart Software Manager. Address that warning before confirming the management change.

In this lab, the confirmation and selected response messages were:

Finish the SCC wizard. The device initially shows Onboarding; its details then report discovery in progress. Wait for registration to complete before performing the final checks below.

Method 2: Serial Number and FDM Auto-Enrollment#

Retrieve the Correct Serial Number

On the second appliance, run:

At the FXOS prompt, run:

Record the chassis Serial (SN). The inventory also lists storage, power-supply, and fan serial numbers; use the appliance identifier required for onboarding.

Create the Device Record in SCC

Return to Security Devices > + > FTD, then:

1. Select Use Serial Number.
2. Select Cloud-Delivered FMC as the manager.
3. Enter Device Serial Number and Device Name, then select Next.

Figure 4. Create the second appliance's record using its serial number.

At Password Reset, select No, this device has been logged into and configured for a manager, matching this lab's starting state. This option expects the device's initial password to have already been changed.

Figure 5. Select the option that matches the appliance's existing configuration.

Assign Default Access Control Policy and select the required subscriptions. This lab selects IPS and Malware Defense. Complete the wizard and select Go to Security Devices.

Start Auto-Enrollment from FDM

On the second appliance, open FDM > Device > System Settings > Remote Management > Cloud Services:

1. Set Enrollment Type to Security/CDO Account.
2. Enable Auto-enroll with Cisco Defense Orchestrator or Secure Firewall Management Center.
3. Select Register, then review and accept the Cisco Disclosure.

Create the serial-number record in SCC before this step. The FDM notice states that auto-enrollment requires the manager to recognize that serial number.

Figure 6. Start cloud enrollment from the locally managed appliance.

FDM shows Registration in Progress. Its Task List also reports that enrollment with the Cisco cloud is in progress. Continue with verification once registration finishes.

Verification#

Run show managers on both appliances. These fields are excerpted from the successful CLI checks; the manager hostname is redacted:

Check the result in both management views:

Figure 7. The first appliance is synced and online after CLI registration.

Figure 8. The second appliance is synced and online after serial-number onboarding.

Expected Alerts in This Fresh-Install Lab

The data interfaces were down and carried no traffic. As confirmed during the lab, the related Error/Offline summary and health alerts were expected in this fresh-install state. Read these separately from the completed manager registration and SCC's Synced / Online status.

Before using the appliances for production traffic, configure the required interfaces and policy, then check device health and traffic behavior. Default Access Control Policy was the onboarding choice for this lab.

Conclusion#

Both FPR-3110 appliances completed registration with cdFMC. The CLI method applied SCC's generated command directly on FTD; the serial-number method paired an SCC device record with FDM auto-enrollment. The recorded checks show completed registration, deployed policy, and SCC configuration synchronization for both appliances.

Cisco Documentation#

• Enable Cloud-Delivered Firewall Management Center
• Onboard a Device with a CLI Registration Key
• Onboard to cdFMC Using Serial Number / Zero-Touch Provisioning
• Prerequisites and Network Requirements