What Is Cisco Security Cloud Control?
Cisco Security Cloud Control (formerly known as Cisco Defense Orchestrator or CDO) is a cloud-delivered security management platform for centralized policy, configuration, logging, and operational management across supported Cisco firewalls and cloud security controls. This guide explains supported platforms, management capabilities, licensing structure, logging options, version requirements, and key procurement considerations for Firewall Management in Security Cloud Control.
What Firewalls Does Cisco Security Cloud Control Support?
The platform provides a common management layer for distributed firewalls and cloud security controls. The management depth is not identical across every product. While full configuration access is available for Cisco Secure Firewall series, cloud-native endpoints receive different levels of visibility.
| Platform | Supported Scope | Management Limitation |
|---|---|---|
| Cisco Secure Firewall ASA | Policy and configuration management | Requires supported ASA software versions |
| Cisco Secure Firewall Threat Defense | Policy and configuration management | Requires supported FTD software versions |
| Cisco Multicloud Defense | Cloud security management, shared objects, site-to-cloud VPN | Dependent on Multicloud Defense consumption tier |
| Cisco Meraki MX | Included as a supported security platform | Requires compatible Meraki entitlement |
| Cisco Secure Routers | Included for Catalyst SD-WAN and NGFW-related management | Security policy focus |
| Cisco Secure Access | Contributes to the SASE management experience | Policy coordination only |
| AWS security groups | Included as a cloud-native security control | Cloud-native policy visibility |
| Cisco IOS through SSH | CLI Tool and Change Log | Not equivalent to full firewall policy management |
Management Workflows for Core Platforms
Cisco Secure Firewall Threat Defense (FTD)
For organizations deploying Cisco FTD, Security Cloud Control acts as the primary orchestrator for Access Control Policies (ACP) and intrusion rules. Administrators can deploy uniform threat signatures and URL filtering policies from the cloud without deploying an on-premises Firewall Management Center (FMC). The cloud console centralizes the object dictionary (such as IP addresses, network ranges, and port definitions), ensuring that a policy update propagates correctly to physical appliances like the Firepower 3100 series or virtual instances like FTDv.
Cisco Secure Firewall ASA
For legacy or high-performance ASA deployments, Security Cloud Control supports full policy and configuration management. Administrators can configure network address translation (NAT), IPsec VPNs, and access control lists (ACLs) directly from the cloud UI. Crucially, the platform manages ASA configurations without breaking existing local command-line interface (CLI) logic, providing an event log that tracks all configuration changes made either locally or via the cloud.
Cisco Meraki MX and Multicloud Defense
While Meraki MX primarily relies on the Meraki Dashboard, Security Cloud Control unifies its visibility alongside enterprise FTD and ASA platforms. For Cisco Multicloud Defense, the platform establishes site-to-cloud VPN connections and handles shared objects, allowing security teams to enforce consistent policies across physical data centers and public cloud egress points.
Core Policy Management & Migration Capabilities
Security Cloud Control is engineered to maintain policy consistency and handle bulk administration across highly distributed environments. The features extend beyond basic firewall rule creation.
Centralized Object Management and Templates
Administrators can create shared objects and apply policy templates across multiple tenants or devices. For instance, a “Blocklist” network group can be defined once and attached to dozens of firewall policies. The system allows Staged Deployments, a critical feature for change control. Configurations are validated, resolving potential conflicts or overlapping rules, before they are committed to the actual device. This ensures that a misconfigured subnet definition does not accidentally sever connectivity during a production maintenance window.
ASA-to-FTD Migration Engine
Transitioning from traditional Layer 4 ASA configurations to next-generation FTD policies can be complex. Security Cloud Control includes a migration engine that analyzes existing ASA configurations and helps map them to FTD Access Control Policies. The engine automatically translates legacy network objects and NAT rules into the FTD policy structure, significantly reducing the manual configuration required when refreshing older ASA 5500-X series hardware to modern Secure Firewall appliances.
AI-Assisted Functions
The platform incorporates AI-assisted functions for policy analysis, capacity insights, and firewall rule assistance. By analyzing the active rulebase, the AI assistant can highlight redundant ACL entries, overlapping shadow rules, and unused objects that consume memory. This should be treated as an administrative aid rather than an automatic substitute for security review.
Bulk Administration and Upgrade Automation
Bulk management tools allow security teams to coordinate operating system image upgrades for Cisco ASA and FTD devices. Upgrades can be staged and downloaded to the flash memory of multiple devices simultaneously, executing the final reboot command globally during the scheduled downtime, reducing operational overhead by hours.
What Is Security Analytics and Logging (SAL SaaS)?
Security Analytics and Logging (SAL SaaS) is a cloud-delivered logging and troubleshooting service. It provides cloud-based log management and exposes firewall connection, intrusion, and system events through the Security Cloud Control event viewer.
EPS Capacity and Throughput Interpretation
The service can handle a sustained peak rate of up to 8,500 events per second (EPS) per firewall device for direct-to-cloud event transmission. This is a logging transmission and processing metric, not a representation of firewall throughput, concurrent sessions, or connection rates. An enterprise gateway handling 10,000 concurrent sessions will generate connection events at the start and teardown of those sessions, safely remaining within the 8,500 EPS logging threshold for standard traffic profiles.
Data Retention and Compliance
SAL SaaS addresses critical compliance requirements by offloading the storage burden of syslog servers. Retaining logs in the cloud ensures that security teams can perform historical threat hunting and generate audit reports even if the local appliance is compromised or disconnected. Different retention tiers are available, allowing organizations to meet regulatory standards that mandate 90-day, 180-day, or 1-year log retention for firewall access events.
How Does Cisco Security Cloud Control Licensing Work?
Cisco has transitioned its licensing model for Security Cloud Control. Legacy CDO-based licensing identifiers have been superseded by the FWM (Firewall Management) ordering model. The required subscription depends on the managed security platform, management scope, logging requirements, retention period, and Multicloud Defense usage.
The licensing architecture consists of the following components:
| Licensing Area | Current Ordering Model (Source-Confirmed) |
|---|---|
| Firewall Management | FWM-SEC-SUB |
| Base Tenant | FWM-BASE |
| Device Management | FWM-FPR1120 (Example) |
| Device Management + Logging | FWM-ML-FP3120 (Example) |
| Security Analytics and Logging | SAL-SEC-SUB |
Procurement Note: Legacy identifiers such as CDO-SEC-SUB, CDO-BASE-LIC, and SAL-CL-LT-1GB are subject to Cisco’s End-of-Life (EOL) announcements. Do not treat example part numbers as universal ordering codes. Verify the current ordering guide and regional availability before quotation.
Presales Sizing Scenarios
To properly size a Security Cloud Control deployment, hardware volume and logging needs must be evaluated.
Scenario A: Multi-Branch Firewall Management without Cloud Logging
An organization is deploying 20 Cisco Secure Firewall 1120 appliances across its retail branches. They use an on-premises SIEM for logs but require centralized policy management.
– Required Base: 1x FWM-BASE (to establish the tenant)
– Required Device Licenses: 20x FWM-FPR1120 (for managing the specific 1120 series hardware)
Scenario B: Headquarters with Full Cloud Logging (High Availability)
A company operates two Cisco Firepower 3120 appliances in a High Availability (HA) cluster at their headquarters and requires 90-day log retention in the cloud for compliance.
– Required Base: 1x FWM-BASE
– Required Device & Logging Licenses: 1x FWM-ML-FP3120 (Cisco’s current licensing rules mandate that an HA pair consumes only 1 device management license. This combined SKU enables both Device Management and Security Analytics & Logging for the 3120 HA pair).
What Software Versions Are Supported?
The support matrix in the referenced documentation specifies the following software baselines. Support versions are documentation-specific and may change in later releases. Verify the current support matrix before deployment or quotation.
| Supported Platform Group | ASA Software Baseline | FTD Baseline |
|---|---|---|
| ASAv | 8.4 and later | N/A |
| ASA 5506-X / 5512-X / 5525-X through 5555-X | 8.4 and later | N/A |
| ISA 3000 | 8.4 and later | 7.0.3 and later, excluding 7.1 |
| Firepower 1010, 1120, 1140, 1150 | 9.8 and later | 7.0.3 and later, excluding 7.1 |
| Firepower 2110 through 2140 | 9.8 and later | 7.0.3 and later, excluding 7.1 |
| Firepower 3100, 3120, 3130, 3140 | 9.17.1 and later | 7.1 and later |
| Firepower 3105 | 9.19.1 and later | 7.1 and later |
| Firepower 4112 through 4145 | 9.4 and later | 7.0.3 and later, excluding 7.1 |
| Firepower 4215 through 4245 | 9.20 and later | 7.4 and later |
| Firepower 9300 | 9.4 and later | 7.0.3 and later, excluding 7.1 |
| FTDv on KVM, VMware, or Azure | N/A | 7.0.3 and later, excluding 7.1 |
Ordering and Validation Checklist
Before requesting a quotation, verify the following details:
- Managed firewall models and virtual platforms.
- Exact ASA or FTD software versions for each device group.
- Tenant requirements and administrative domains.
- Current EOL status of legacy CDO and SAL licensing (verify replacement FWM SKUs).
- Expected daily log volume and log retention period.
- Multicloud Defense gateway consumption model.
Each required management or logging function should be mapped to the applicable entitlement before ordering.