Deploy an FTDv Gateway in AWS Using MCD

Available Languages

Download Options

  • PDF     (3.1 MB)
    View with Adobe Reader on a variety of devices
  • ePub     (3.1 MB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (1.8 MB)
    View on Kindle device or Kindle app on multiple devices
Updated:October 19, 2026
Document ID:226449

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.


Introduction

This document describes how to onboard your AWS account to Cisco Multicloud Defense (MCD) and deploy FTDv gateways by using the Cisco MCD controller.

Prerequisites

  • A cloud-delivered Firewall Management Center (cdFMC) provisioned for the SCC tenant.
  • An AWS EC2 Key Pair available in the region targeted for deployment.
  • An AWS account with sufficient IAM permissions to deploy a CloudFormation stack.
  • An active Cisco Multicloud Defense subscription/entitlement on the SCC tenant, along with the applicable FTDv license types and performance tier entitlements.
  • SCC administrative access with rights to manage Platform Subscriptions and Multicloud Defense infrastructure.
  • AWS Console access with permissions to create and monitor CloudFormation stacks and EC2 resources.

Requirements

Cisco recommends that you have knowledge of these topics:

  • Cisco Security Cloud Control (SCC) navigation
  • Basic AWS networking concepts (VPC, CIDR, Transit Gateway, Availability Zones)
  • AWS CloudFormation stack deployment and review

Components Used

  • Cisco Security Cloud Control (SCC)
  • Cisco Multicloud Defense (MCD)
  • Cisco Secure Firewall Threat Defense Virtual (FTDv)
  • Cloud-delivered Firewall Management Center (cdFMC)
  • Amazon Web Services (AWS) – CloudFormation, EC2, VPC, Transit Gateway

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

This document covers a first-time MCD deployment into a single AWS account and region using a Transit Gateway (TGW) network type. AWS Cloud WAN network types and ingress gateway deployments are outside the scope of this document, as ingress gateways are not currently supported by MCD.

note-icon

Note: Ingress gateways are not currently supported by Multicloud Defense. Only Egress/East-West gateway deployments are covered in this document.

note-icon

Note: If the initial cdFMC registration attempt fails or times out, this is expected behavior. Allow additional time for the cluster to retry registration automatically before troubleshooting further.

Configure

Enable Cisco Multicloud Defense on the SCC Tenant

  1. In the Cisco Security Cloud Control (SCC) console, navigate to Home > Platform Management > Subscriptions.

    Enable Cisco Multicloud Defense

  2. Enable the Multicloud Defense subscription for the tenant.

Enable the Multicloud Defense Subscription for the Client

Onboard an AWS Account (CSP Account)

This step connects an AWS account to the Multicloud Defense Controller so MCD can deploy and manage resources on its behalf. This example uses AWS as the Cloud Service Provider (CSP).

    1. From the SCC left navigation pane, select Multicloud Defense. Onboard an AWS Account (CSP Account)
    2. Navigate to Infrastructure > CSP Accounts. Navigate to Infrastructure , CSP Accounts
    3. Select Add Account. Select Add Account
    4. From the Account Type drop-down, select AWS.
    5. Select Launch Stack. This opens a new browser tab and launches an AWS CloudFormation stack that deploys the IAM roles and resources required for MCD to integrate with the AWS account. Select Launch Stack and New Browser Tab Opens
    6. In the AWS Console, confirm the CloudFormation stack completes successfully.
       
      Confirm CloudFormation Stack
    7. Open the Outputs tab of the CloudFormation stack. These values are required in the next step. Open the Outputs Tab of CloudFormation Stack
    8. In the MCD Add Account form, enter these values:
      AWS Account Number: The AccountNumber output from the CloudFormation stack.
      AWS Account Name: A friendly, identifiable name for this AWS account within MCD.
      Controller IAM Role: The MCDControllerRoleArn output from the CloudFormation stack.
      Inventory Monitor Role: The MCDInventoryRoleArn output from the CloudFormation stack.

Enter Values in MCD Account

9. Save the account. The AWS account is onboarded to MCD.

Create a Service VPC

The Service VPC hosts the networking infrastructure (subnets, route tables, Transit Gateway) used by the FTDv gateway.

    1. Navigate to Multicloud Defense > Infrastructure > Service VPCs/VNets. Create a Service VPC
    2. Select Create. Select Create
    3. Configure the VPC settings:
      Name: A unique, easily identifiable name for the VPC.
      CSP Account: The AWS account integrated in Step 2.
      Region: The AWS region where the FTDv cluster is launched.
      CIDR Block: A CIDR range dedicated to this MCD deployment (must not overlap with existing VPCs).
      Availability Zones: At least one AZ; two are recommended for redundancy.
      Network Type: Select Transit Gateway (TGW). CloudWAN is a separate network type used specifically for AWS Cloud WAN deployments and is out of scope for this document.
      Transit Gateway: Select create_new, with a unique name for the new Transit Gateway.
      NAT Gateway (optional): Enables all egress traffic to route through a NAT Gateway. Not enabled in this example; NAT Gateway configuration is out of scope for this document.

Configure VPC Settings


4. Select Save.

Start the FTDv Gateway Wizard

  1. Navigate to Multicloud Defense > Infrastructure > Gateways. Start the FTDv Gateway Wizard
  2. Select Add Gateway. Select Add Gateway
  3. Configure the initial settings:
    Accounts: The CSP account integrated in Step 2.
    Gateway Type: Select FTDv Gateway.
    Name: The display name for this cluster in MCD.
    Instance Type: The instance size matching the required throughput and performance needs. This example uses the minimum supported type, C5_XLARGE.
    Minimum/Maximum Instances: The desired scaling range. Minimum is 1 instance; maximum is 10.
    HealthCheck Port: Default is 65534;  change only if a different port has been specified for the MCD load balancer. If changed, the port must be allowed in any datapath security groups associated with the FTDv instances.

    Configure the Initial Settings

  4. Select Next.

Configure Gateway Properties

Properties: Select Egress/East-West. Ingress gateways are not currently supported.
FTDv Version: The software version best suited to the environment.
Policy Ruleset: The access control policy (ACP) to apply to this FTDv cluster.
Password: A password for the FTDv instances.
License Model: The desired licensing model.
Performance Tier: The tier appropriate for the expected device throughput.
License Types: The license types purchased for this deployment.
Region: The region where these FTDv instances are deployed.
VPC/VNet ID: The Service VPC created in Step 3.
Key Pair: An existing AWS Key Pair.
Gateway IAM Role: The role containing gateway in its name, corresponding to the MCDFirewallRoleName value from the CloudFormation stack in Step 2. Selecting this role automatically populates the associated Security Groups.
EBS Encryption: AWS-managed encryption is selected by default. Amazon EBS automatically and transparently encrypts block storage volumes, data in transit, and snapshots.

1. Select Next.

Configure Gateway Properties

Configure Management Security Group

Configure Advanced Settings (Optional)

Advanced Settings allow configuration of options such as disabling public IP addresses for the FTDv instances. Advanced settings are not configured in this example.

Review and Deploy

  1. Review all configured settings for accuracy.
  2. Select Finish to begin deployment. Review and Deploy 1 Review and Deploy 2
note-icon

Note: Deployment can take up to 30 minutes. During this time, MCD provisions and clusters the specified number of FTDv instances and registers them with cdFMC.

Verify

Use this section in order to confirm that your configuration works properly.

Deployment and registration success can be confirmed from several locations:

  • cdFMC: Immediately after selecting Finish, the new cluster appears (in a pending state) in cdFMC under Devices > Device Management. Device Management
  • MCD Gateway Details: Selecting the gateway name opens a details panel showing launch progress.


    Select the specified name then click the Instances tab.

    MCD Gateway Details
  • AWS EC2 Console: Individual instance status can be monitored directly in EC2 > Instances. AWS EC2 Console with Instances Status
  • cdFMC Tasks Tab: Registration progress is tracked here:

    Registration continuing:

    Registration Progress

    Registration success:

    Registration Success
  • Final State: After successful registration, the gateway shows an Active - Pending status before transitioning to fully Active, confirming the cluster is deployed and operational. Final State

Troubleshoot

This section provides information you can use in order to troubleshoot your configuration.

  • Initial registration attempt fails or times out in the cdFMC Tasks tab – Expected behavior on the first registration attempt. Allow additional time for the cluster to retry registration automatically before further troubleshooting.
  • CloudFormation stack fails to complete – Verify the AWS IAM user/role deploying the stack has sufficient permissions, and review the Events tab for the specific failure reason.
  • Gateway IAM Role or Security Groups do not populate in the Gateway wizard – Confirm the CloudFormation stack in Step 2 completed successfully and that the correct CSP Account and Region were selected.

Summary

Completing this procedure results in:

  • Multicloud Defense enabled on the SCC tenant.
  • AWS account onboarded via CloudFormation.
  • Service VPC created with a Transit Gateway.
  • Clustered FTDv gateway deployed and registered to cdFMC.

The FTDv gateway is active and ready for policy configuration and traffic inspection.

Related Information

Revision History

Revision Publish Date Comments
1.0
19-Oct-2026
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Shelby Wesnitzer
    Technical Consulting Engineer

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products