Cisco Security Cloud Control: On-Premises Managed Firewall Threat Defense Migration to Cloud Management

PDF

Cisco Security Cloud Control: On-Premises Managed Firewall Threat Defense Migration to Cloud Management

Supported features

Updated: September 29, 2026

Want to summarize with AI?

Log in

Learn how Security Cloud Control imports shared policies and device configurations from On-Premises Firewall Management Center, including supported policy types and duplicate policy or object name handling.

Shared policies imported

The following policies are imported first and then followed by the device configuration:

  • Access control

  • IPS

  • SSL

  • Prefilter

  • NAT

  • QoS

  • Identity

  • Platform settings

  • Flex config

  • Network analysis

  • DNS

  • Malware & file

  • Health

  • Remote Access VPN

  • Site-to-Site VPN

Handling duplicate names

If a policy or object name in Security Cloud Control Firewall Management matches one imported from the On-Premises Firewall Management Center, Security Cloud Control Firewall Management will take the following actions after a successful management change.

Policies, Objects

Condition

Action

Access control, SSL, IPS, Prefilter, NAT, QoS, Identity, Platform settings, Network analysis, DNS, Malware & File policies.

Name of the Cloud-Delivered Firewall Management Center policy matches the On-Premises Firewall Management Center policy.

Cloud-Delivered Firewall Management Center policy is used.

RA VPN Default group policy DfltGrpPolicy

The default group policyDfltGrpPolicy from the On-Premises Firewall Management Center is ignored.

Existing Cloud-Delivered Firewall Management Center default group policy DfltGrpPolicy is used.

Network, Port objects

Name and content of network and port objects in the Cloud-Delivered Firewall Management Center match the ones in the On-Premises Firewall Management Center.

Existing Cloud-Delivered Firewall Management Center network and port objects with the same name and content are used.

If the object has the same name but different content, an object override is created.

All other objects

Existing Cloud-Delivered Firewall Management Center object is used.
Note

Syslog alert objects used by access control policies are imported. If Security Cloud Control has an SNMP or email alert object with the same name as a source-On-Premises Firewall Management Center syslog alert object, the existing object is reused. Check for name collisions and rename the source syslog object before migration when necessary.