Security Cloud Control Firewall Management Ordering Guide

 

Introduction

This ordering guide is designed to help Cisco sales teams, partners, and distributors order Security Cloud Control Firewall Management. This guide will help you:

●      Understand various offers

●      Understand specific ordering SKUs for your customers’ needs

●      Make sure that the right quantities are selected to reduce the risk of order rejection

●      Provide information about the end-to-end quote-to-fulfillment process in Cisco Commerce

This guide is intended for Cisco sales teams, partners, and distributors qualified to sell Cisco Security Cloud Control Firewall Management on the Cisco Global Price List.

Product overview

Security Cloud Control is Cisco’s unified, cloud-native security management interface for the Cisco’s Hybrid Mesh Firewall. It simplifies and strengthens defenses by centralizing security solutions into a single, cohesive interface. This approach eliminates silos, reduces complexity, and provides end-to-end visibility, empowering organizations to proactively address security challenges across their entire infrastructure.

Security Cloud Control provides real-time visibility, streamlines workflows, and enhances security with centralized control and AI-driven insights by providing a unified platform form managing Hybrid Mesh Firewall and Universal ZTNA.

Today, Security Cloud Control brings together the management of:

●      Cisco Secure Firewall (FTD and ASA)

●      Cisco Multicloud Defense

●      Cisco Hypershield

●      Cisco Secure Workload (SaaS)

●      Cisco Secure Access

●      Cisco AI Defense

The product “Firewall Management” in Security Cloud Control relates to the features and capabilities for managing Firewalls (FTD, ASA) in Security Cloud Control. This also incorporates the cloud-delivered Firewall Management Center (FMC), providing a fully unified experience between on-premises and cloud-based firewall management. The Security Cloud Control Firewall Management tenant is available in various Geo locations such as AMER, EU, APJ, ANZ, India.

Scope

This guide addresses the ordering experience for Firewall Management in Security Cloud Control. For managing other products in Security Cloud Control, please refer the Ordering guides of the individual products.

For information about ordering Cisco network security devices and services or feature licenses on the Secure Firewall (Essential, IPS, URL Filtering, Malware etc.) refer to: Cisco Network Security Ordering Guide.

Product licensing overview

Firewall Management in Security Cloud Control has two types of licensing: Base Subscription and per-device licensing. Both are needed for managing Firewalls. Apart from that, there is optional licensing for Firewall logging. (covered in Table 1).

For Multicloud Defense, the product licensing is based on the consumed amount of aggregated gateway hours across all the cloud environments. The product has two tiers available, namely, Advantage and Premier. Firewall device licenses, such as Threat, Malware, URL filtering, and support, should be purchased separately. Security Logging and Analytics can also be added for logging and troubleshooting use cases. For more information on Multicloud Defense ordering, visit Multicloud Defense ordering guide.

Table 1. Product Packaging

Logging Licensing

For customers who don’t wish to use the Management with Unlimited Logging option, they can buy logging capacity a-la-carte.

Free Tier Capabilities

Cisco customers who purchase FMC licenses are entitled to the following cloud-delivered services commonly referred to as Cloud-Assist features. This requires the FMC to integrate with Cisco Security Cloud.

1.     Onboarding a customer’s FMC for centralized object management and inventory view

2.     Low Touch Provisioning for onboarding devices to on-prem FMC using the Serial based onboarding

3.     Send events to the cloud, for FMC managed Firewalls (requires the purchase of Logging license in Table 1)

4.     AIOps

5.     Policy Analyzer and Optimizer

6.     Cisco AI Assistant

7.     XDR Automation workflow, to automate security response by policy modifications

If the Security Cloud Control is being used for any of the above capabilities and not for device management, it does not require any subscription purchase. Simply, request a tenant here.

Service and Support Licensing

Security Cloud Control Firewall Management includes software subscription support. It is essential to keeping business-critical applications available, highly secure, and operating at optimal performance. For the term of the software subscription license, customers receive timely, uninterrupted access to the latest software updates. These may contain significant architectural changes and new features and functions. The software subscription support helps ensure that customers have the current solution working to protect their businesses. It also provides access to a wide range of online tools and communities that help customers solve issues quickly, strengthen their business continuity, improve their competitiveness, and make the most of limited resources through increased productivity. This support entitles customers to the services listed here for the full term of the purchased software subscription:

●      Software updates and major upgrades to keep applications performing optimally with the most current feature set

●      Access to the Cisco Technical Assistance Center, which provides fast, specialized support.

●      Online tools to build in-house expertise and boost business agility.

●      Collaborative learning for additional knowledge and training opportunities.

The Base License Subscription SKU includes Basic Support for Firewall Management in Security Cloud Control, SVS-FWM-SUP-B, at no cost and is selected by default. Solution Support for Firewall Management in Security Cloud Control, SVS-FWM-SUP-S, can be added for Solution Support. For more details on solution support visit Solution Support - Services (CX). These support options have the same term as the Firewall Management in Security Cloud Control Base License Subscription, and either Basic Support or Solution Support must be added.

Ordering Process

Quoting Guidelines

Firewall Management in Security Cloud Control requires a base subscription for tenant entitlement and a per-device license for device management entitlement. The licenses are offered as a subscription of 1, 3, or 5 years.

● Base Tenant Subscription: It is priced per tenant and is based on the number of tenants. You can add only one Base Tenant subscription per order. To multiple tenants, a new order has to be placed.

● Per-Device Licensing: Device licenses are based on the model number and quantity per model. For instance, if you are ordering 10 Cisco Secure Firewall devices and you want to manage these in a single tenant, you need to order 1 Base License Subscription and 10 per-device SKUs for the respective Cisco Secure Firewall devices. The per-device licensing does not depend on the type of Firewall OS (FTD or ASA) running on the device platform.

● Firewall Threat Defense (FTD): The cloud-delivered Firewall Management Center (FMC) to manage FTD devices is included in the Base Tenant Subscription.

● High-availability devices: In a high-availability pair, since only one device is passing traffic at any given time, for licensing purposes, a high-availability pair of managed devices will count as one device license.

● Clustered devices: In a cluster, multiple devices are passing traffic. For licensing purposes, the number of per-device licenses bought must be equal to the number of devices in the cluster.

● Multi-Instance Deployment: For firewalls deployed in Multi-Instance mode, the licenses are not counted per container instance. For example, a Secure Firewall 4215 running 10 instances will require only one 4215 device license.

● Multi-Context Deployment: For ASA devices that support multicontext, the Security Cloud Control Firewall Management licensing is sold for just the device itself. Each context will be managed as a separate firewall, but the charge only applies to the admin context.

The quoting process outlined here considers three scenarios:

1.     Purchasing Firewall Management and Unlimited Logging Storage in Security Cloud Control

2.     Purchasing Firewall Management in Security Cloud Control with Cloud Logging as Optional Add-on

3.     Discounted Bundling when attaching with Firewall Subscriptions

Scenario 1: Purchasing Firewall Management and Unlimited Logging Storage in Security Cloud Control

Possible Use Cases

● Firewalls already purchased as part of a different order

● Existing Firewall Deployment already managed using on-prem FMC/FDM. Now looking to migrate the management to Security Cloud Control

● Customer does not wish to estimate logging requirements or is looking to store a large amount of logging volume over a 90-day rolling retention period.

Step 1: Selecting the Subscription SKU

There is one subscription SKU for Firewall Management in Cisco Security Cloud Control (FWM-SEC-SUB). There is no price for the subscription SKU. Pricing is determined when product SKUs are added and configured. The quantity is fixed at 1because each end customer may have only one subscription. Product quantities will be entered when the product SKUs are added to the subscription.

a.     Search FWM-SEC-SUB and add it.

b.   Click Select Options to add product SKUs to the subscription.

Step 2: Adding Product SKUs

The next step is to add products to the subscription. Here you will add the model and quantity of device platforms to be managed.

Firewall Management Base Tenant SKU

This represents the base tenant subscription for managing the Firewalls. It is mandatory. If not added here, it will be added automatically when the Management and Logging Product SKUs are added. This is fixed at 1. If there is a need to purchase multiple tenants, additional orders need to be placed as each order allows only one tenant.

Cloud Management license with unlimited logging and 90 days retention

This represents the per Firewall platform SKU representing the specific Firewall model. This SKU provides entitlement to device management and unlimited logging storage with 90 days of rolling retention. The Quantity represents the number of devices you wish to manage. Refer to Quoting Guidelines for understanding the requirements for High Availability, Clustering, Multi-Instance or Multi-Context deployments.

In this example 2xFWM-ML-FP1150 SKUs are added, which entitle the customer to onboard and manage 2x1150s. Also, it provides entitlement for unlimited log storage for both with a 90-day rolling retention period.

Scroll to find the relevant platform model SKUs and add combination of SKUs as per your requirements. The complete list is available in the Appendix A.

Step 3: Adding Service and Support SKUs

Click Service Tab at the top, next to Subscription. There are two options here: Basic Support and Solution Support for Firewall Management in Security Cloud Control. The SKU list is available in Appendix A.

When one of the product SKUs are added, the Solution support is added by default. Click Swap if you wish to instead use Basic Support, which is available at zero cost. At least one support SKU needs to be selected.

Step 4: Modify Term Details

Click Terms Tab at the top right to view the details of the Terms. By default, it is 36 months. To adjust this, click the Edit button and makes changes required to the subscription and renewal under New Terms and Billing and click Save Changes button.

At time of ordering, the subscription is set to auto-renew as a default, however, auto-renew can be turned off (toggle button on lower left as shown above) without triggering the deal to become nonstandard.

Step 5: Validate the order

Click the Summary tab at the top to ensure the order reflects the desired quantity and type of SKUs. Click Verify and Save to proceed with the order completion.

Scenario 2: Purchasing Firewall Management in Security Cloud Control with Cloud Logging as Optional Add-on

Possible Use Cases

● Firewalls already purchased as part of a different order

● Existing Firewall Deployment already managed using on-prem FMC/FDM. Now looking to migrate the management to Security Cloud Control

● Customer has specific logging estimates, wishes to buy a fixed amount of logging which can be modified later based on usage.

● Customer wishes to have a log retention period greater than 90 days

Step 1: Selecting the Subscription SKU

There is one subscription SKU for Firewall Management in Cisco Security Cloud Control (FWM-SEC-SUB). There is no price for the subscription SKU. Pricing is determined when product SKUs are added and configured. The quantity is fixed at 1because each end customer may have only one subscription. Product quantities will be entered when the product SKUs are added to the subscription.

a.   Search FWM-SEC-SUB and add it.

b.   Click Select Options to add product SKUs to the subscription.

Step 2: Adding Base Tenant SKUs

The next step is to add products to the subscription. Here you will add the Base Tenant SKU.

Firewall Management Base Tenant SKU

This represents the base tenant subscription for managing the Firewalls. Click Add. It is mandatory. If not added here, the order cannot be verified and saved. This is fixed at 1. If there is a need to purchase multiple tenants, additional orders need to be placed as each order allows only one tenant. Click Verify and Save.

Step 3: Adding Service and Support SKUs

Click Service Tab at the top, next to Subscription. There are two options here: Basic Support and Solution Support for Firewall Management in Security Cloud Control. The SKU list is available in Appendix A.

When one of the product SKUs are added, the Solution support is added by default. Click Swap if you wish to instead use Basic Support, which is available at zero cost. At least one support SKU needs to be selected.

Step 4: Modify Term Details (Optional)

Click Terms Tab at the top right to view the details of the Terms. By default, it is 36 months. To adjust this, click the Edit button and makes changes required to the subscription and renewal under New Terms and Billing.

At time of ordering, the subscription is set to auto-renew as a default, however, auto-renew can be turned off (toggle button on lower left as shown above) without triggering the deal to become nonstandard.

Click Save Changes button. Click the Summary tab at the top to ensure the order reflects the desired quantity and type of SKUs. Click Verify and Save to proceed with the next step.

Step 5: Add per-Device Management SKUs (No logging included)

This represents the per Firewall platform SKU representing the specific Firewall model. This SKU provides entitlement to device management only. The Quantity represents the number of devices you wish to manage. Refer to Quoting Guidelines for understanding the requirements for High Availability, Clustering, Multi-Instance or Multi-Context deployments.

a.   Search for Cloud Management and choose the relevant SKUs. Scroll to find the relevant platform model SKUs and add combination of SKUs as per your requirements. The complete list is available in the Appendix A.

b.   In this example 1 x L-FPR4215-P= SKUs are added, which entitles the customer to onboard and manage 1x4215. It does not provide any logging entitlement. Click Edit Service/Subscription.

c.   Click Edit Subscription and choose the subscription duration. The default is 3 years. Change if required but it is recommended that this matches the Term length of the Firewall Management Base Tenant SKU.

d.   Click Apply to add this. Repeat a, b and c steps of this Step 5, to add device management for more Firewall models.

e.   Click Done after adding all the required device management SKUs for the Firewall models.

Step 6: Add Cloud Logging SKUs (Optional)

By purchasing this, the customer benefits from Centralized Log Management in the Cloud for Long Term Retention, Troubleshooting and Compliance. The Logging Subscription SKUs can be bought standalone also without purchasing any device management SKUs.

a.   Search for SAL-SUB and add it.

b.   Click Select Options to configure the SAL logging requirements.

c.   Depending on the logging requirements, there are options to buy Cloud Datastore known as SAL SaaS and On-prem Datastore based logging known as SAL On-prem. This ordering guide is only going to cover the SAL SaaS i.e. Cloud Datastore. For On-prem Datastore, please refer to the Security Analytics and Logging Ordering guide. Enter the number of GB/Day logging storage needed. This is the daily ingest rate you expect for the event storage.

Note: You can either estimate the logging requirements using the Performance Estimator Tool or use metrics within the existing installation such as Netflow data.

d.   By default, the license includes a rolling retention period of 90 days. If the 90 days retention period is insufficient, selecting one of the options from (1, 2 or 3 years) extends the retention period by the selected duration as an add-on to the included 90-day retention period. In this example, a 2-year extension pack is chosen which will provide 2 years of additional retention in addition to the default 90 days retention.

e.   There are two options here: Basic Support and Solution Support for Security Analytics and Logging SaaS. The SKU list is available in Appendix A. Online Support is added by default when you add the Logging Quantity. If you wish to add Solution Support, click Service Tab at the top, next to Subscription. Click Add if you wish to instead use Solution Support. It will remove the Online Support SKU.

 

f.    Modify Term Details (Optional). Click Terms Tab at the top right to view the details of the Terms. By default, it is 36 months. To adjust this, click the Edit button and makes changes if required to the subscription and renewal under New Terms and Billing.

g.   It is recommended that this matches the Term length of the Firewall Management Base Tenant SKU. At time of ordering, the subscription is set to auto-renew as a default, however, auto-renew can be turned off (toggle button on lower left as shown above) without triggering the deal to become nonstandard. Click Save Changes.

h.   Click Verify and Save. Click Save and Continue to finish adding products.

Scenario 3: Discounted Bundling When Attaching with Firewall Subscriptions

Possible Use Cases

●      Purchasing Firewall Management and/or Cloud Logging along with the Firewall subscriptions

Step 1: Adding Firewall Subscription

Here is the ordering process starts by first choosing the Firewall model to be purchased. The Management and Logging SKUs are part of those subscriptions. Search for a Firewall model. Here FPR4225-NGFW-K9 is used as an example. Click Add.

Step 2: Adding Firewall Management and Cloud Logging in Security Cloud Control

Click Edit Options to add Management and Logging SKUs.

a.   Select Extended Logging and Analytics. You are presented with two options Cloud Data Store or On-Premises Data Store. Only one can be selected per firewall being ordered, with either the same or different subscription term as the firewall subscription. In this example, we are using Cloud Data Store.

b.   Choosing Cloud Data Store (selected by default) will attach a default logging volume in GB/day for that Firewall model, based on the expected daily volume of logs generated by that Firewall model. By default, the license includes a rolling retention period of 90 days. If the 90 days retention period is insufficient, selecting one of the options from (1, 2 or 3 years) extends the retention period by the selected duration as an add-on to the included 90-day retention period.

c.   Select Cisco Defense Orchestrator. Choose the Cloud Management SKU, FPR4225-P in this example. This will add subscription for Firewall Management in Security Cloud Control. By default, it is added for 3 years but can be modified.

Step 3: Adding the Firewall Management Base Tenant Subscription SKU

The above subscriptions don’t provide the entitlement to the Security Cloud Control Firewall Management Tenant. It is mandatory to add the Base Tenant Subscription SKU to enable provisioning. There is one subscription SKU for Firewall Management in Cisco Security Cloud Control (FWM-SEC-SUB). There is no price for the subscription SKU. Pricing is determined when product SKUs are added and configured. The quantity is fixed at 1because each end customer may have only one subscription. Product quantities will be entered when the product SKUs are added to the subscription.

a.   Search FWM-SEC-SUB and add it.

b.   Click Select Options to add product SKUs to the subscription.

c.   The next step is to add the Firewall Management Base Tenant SKU. This represents the base tenant subscription for managing the Firewalls. Click Add. It is mandatory. If not added here, the order cannot be verified and saved. This is fixed at 1. If there is a need to purchase multiple tenants, additional orders need to be placed as each order allows only one tenant. Click Verify and Save.

Provisioning information

After the order has been placed, a claim code will be created for the end customer and emailed to the address specified above for subsequent provisioning. Refer to the Security Cloud Control user guide for details. Upon activation, the end-customer administrator will receive a welcome email with instructions to log in to the Security Cloud Control tenant to enable Firewall Management. When administrators have logged in to the dashboard, they will be aided by a setup guide as well as access to support resources to make sure their accounts are properly set up.

Subscription renewals, changes, and cancellations

At time of ordering, the subscription is set to auto-renew as a default, however, auto-renew can be turned off (toggle button on lower left as shown above) without triggering the deal to become nonstandard.

Subscription changes

Changes to the products, quantities, or terms of a subscription may be made at any time during the term of the subscription. To change the subscription, please refer to this Cisco Commerce Change Subscription Job Aide. Attempting to add products or quantities by creating a new subscription will result in an ordering error.

Subscription cancellations

Renewals may be cancelled up to 60 days before the start date of the new term. If the subscription is not cancelled, the subscription will automatically renew. Midterm cancellations of subscriptions for credit are not allowed.

Appendix A: Security Cloud Control Firewall Management License SKUs

Table 2. Security Cloud Control Firewall Management SKUs (Base Tenant and Unlimited Logging)

Table 3. SAL Saas logging and troubleshooting XaaS license for logging entitlement

Table 4. Firewall Management in Security Cloud Control: subscription of 1, 3, and 5 years available

Note: All the PIDs listed in Table 3 are available in 1, 3-, and 5-year subscription PIDs. Example: L-FPR4225-P= is available as L-FPR4225-P-1Y, L-FPR4225-P-3Y, and L-FPR4225-P-5Y.

Security Purchasing Programs

The offer leverages the Security Choice Enterprise Agreement purchasing program with the following PIDs: The mapping for Choice EA PIDs to CDO, SAL (SaaS) a-la-carte PIDs