Onboard Devices and Services

You can onboard both live devices and model devices to Security Cloud Control. Model devices are uploaded configuration files that you can view and edit using Security Cloud Control.

Most live devices and services require an open HTTPS connection so that the Secure Device Connector can connect Security Cloud Control to the device or service.

See Secure Device Connector for more information on the SDC and its state.

This chapter covers the following sections:

Supported Devices, Software, and Hardware

Security Cloud Control is a cloud-based management solution enabling the management of security policies and device configurations across multiple security platforms. Security Cloud Control centrally manages policy and configuration across:

  • Cisco Secure Firewall ASA, both on-premises and virtual

  • Cisco Secure Firewall Threat Defense (FTD), both on-premises and virtual

  • Cisco Catalyst SD-WAN Manager

  • Cisco Secure Firewall Management Center, on-premises

  • Cisco Meraki MX

  • Cisco IOS devices

  • Cisco Umbrella

  • AWS Security Groups

The documentation describes devices, software, and hardware Security Cloud Control supports. It does not point out software and devices that Security Cloud Control does not support. If we do not explicitly claim support for a software version or a device type, then we do not support it.

Cisco Secure Firewall ASA

Cisco Adaptive Security Appliance (ASA) is a security device integrating firewall, VPN, and intrusion prevention capabilities. It protects networks from unauthorized access, cyber threats, and data breaches, offering robust security services in a single platform. Security Cloud Control supports the management of ASA devices, offering features to streamline configuration management and ensure regulatory compliance across the network infrastructure.

Cisco Secure Firewall Threat Defense

Firewall Threat Defense integrates traditional firewall features with advanced threat protection capabilities. It offers comprehensive security functions, including intrusion prevention, application control, URL filtering, advanced malware protection, and so on. An FTD can be deployed on ASA hardware appliances, and Cisco firewall hardware appliances, and in virtual environments. Managing threat defense devices is possible through various management interfaces, such as Cisco Firewall Management Center, Security Cloud Control, and Firewall Device Manager.

For more information on software and hardware compatibility, see the Cisco Secure Firewall Threat Defense Compatibility Guide.

Firewall Device Manager is a web-based management interface explicitly designed for threat defense device management. It provides a simplified approach for configuring and monitoring threat defense devices, making it ideal for smaller-scale deployments or organizations preferring an intuitive interface.

FDM offers basic configuration capabilities for network settings, access control policies, NAT rules, VPN configuration, monitoring, and basic troubleshooting. Typically accessed through a web browser, FDM is directly available on the FTD device, eliminating the need for additional management servers or appliances.

Cisco Catalyst SD-WAN Manager

Security Cloud Control offers centralized management for Catalyst SD-WAN and Branch WAN environments, allowing organizations to efficiently configure, monitor, and enforce security policies across their networks. This integration also facilitates advanced troubleshooting, rule optimization, and change management on the Catalyst SD-WAN Manager.

For more information on software and hardware compatibility, see Cisco Catalyst SD-WAN Device Compatibility.

Cisco Secure Firewall Management Center

Security Cloud Control simplifies the management of on-premises Firewall Management Center by establishing a secure integration, discovering security devices, and enabling centralized policy management. Security policies such as firewall rules, VPN settings, and intrusion prevention policies can be efficiently managed and deployed across all devices under FMC.

Cisco Meraki MX

The Meraki MX appliance is an enterprise-grade security and SD-WAN next-generation firewall appliance, designed for decentralized deployments. Security Cloud Control supports managing layer 3 network rules on Meraki MX devices. When you onboard a Meraki device to Security Cloud Control, it communicates with the Meraki dashboard to manage that device. Security Cloud Control securely transfers configuration requests to the Meraki dashboard, which then applies the new configuration to the device. Key features of Security Cloud Control's support for Cisco Meraki MX include centralized policy management, backup and restore, monitoring and reporting, compliance checking, and automation capabilities.

Cisco IOS Devices

Cisco IOS can manage and control network functions, including routing, switching, and other networking protocols. It offers a set of features and commands to configure and maintain Cisco network devices, enabling efficient communication and management within networks of varying sizes and complexities.

Cisco Umbrella

Security Cloud Control manages Cisco Umbrella through integrations such as the Umbrella ASA Integration, which allows administrators to include their Cisco Adaptive Security Appliance (ASA) within their Umbrella configuration using per-interface policies. This integration enables the ASA to redirect DNS queries to Umbrella, enhancing network security by leveraging Umbrella's DNS security, web filtering, and threat intelligence capabilities.

AWS Security Groups

Security Cloud Control offers a simplified management interface for Amazon Web Services (AWS) Virtual Private Clouds (VPCs). Key features include monitoring AWS Site-to-Site VPN connections, tracking changes to AWS devices, and viewing AWS Site-to-Site VPN tunnels.

Cloud Device Support Specifics

The following table describes software and device type support for cloud-based devices. Read the affiliated links for more information about onboarding and feature functionality for the device types in the table below:

Devices Types

Notes

Meraki Security Appliance

  • MX Series

  • Meraki Templates

Meraki MX devices and the Meraki dashboard receive regular software updates through the Meraki cloud.

Security Cloud Control works with the latest version of the Meraki dashboard to manage layer 3 network rules enforced by Meraki MX devices.

See Managing Meraki with Security Cloud Control for more information.

You must register an MX device to, or create a template in, the Meraki dashboard before onboarding it to Security Cloud Control.

Google Cloud Platform

Google Cloud Platform (GCP) receives any updates through the GCP console. See Google Cloud documentation for more information on the platform and available services. See

Microsoft Azure

Azure receives any updates through the Azure console. See Azure documentation for more information on the platform and available services.

Onboard Meraki MX Devices

Onboard Meraki MX to Security Cloud Control

MX devices can be managed by both Security Cloud Control and the Meraki dashboard. Security Cloud Control deploys configuration changes to the Meraki dashboard, which in turn deploys the configuration securely to the device.

Before you begin

  • Review Connect Security Cloud Control to your Managed Devices

  • Review How Does Security Cloud Control Communicate With Meraki

  • You must first register the Meraki MX in the Meraki dashboard. Without having access to the Meraki dashboard, your organization will not be recognized by the Meraki cloud and you will not be able to generate an API token to onboard your device.

  • Security Cloud Control silently converts invalid CIDR prefix notation IP addresses and IP address ranges to valid form by zeroing all bits associated with the host.

  • Onboarding Meraki MX devices or templates no longer requires a connection through a Secure Device Connector (SDC). If you have some Meraki MX devices that have already been onboarded and connect to Security Cloud Control using an SDC, that connection will continue to work unless you remove and re-onboard the device or update its connection credentials.

  • MX devices do not have to be connected to the Meraki Cloud in order to be managed by Security Cloud Control. If a MX device has never connected to the cloud, the device connectivity is listed as unreachable. This is normal, and does not affect your ability to manage or deploy policies to this device.

Procedure

  Command or Action Purpose

Step 1

When you onboard a Meraki MX device, you must generate a Meraki API key. The key authenticates the dashboard and allows you to securely onboard a device. See Generate and retrieve a Meraki API key.

Step 2

Onboard a Meraki Device to Security Cloud Control using the API key.

Generate and Retrieve Meraki API Key

Use this procedure to enable Security Cloud Control access to the Meraki dashboard with API access:

Before you begin
Review the notes and prerequisites on Onboard Meraki MX to Security Cloud Control
Procedure

Step 1

Log into the Meraki dashboard.

Step 2

In the navigation pane, click Organization > Settings.

Step 3

Under Dashboard API Access, check Enable access to the Cisco Meraki Dashboard API. Without this option, you cannot generate API keys to onboard MX devices to Security Cloud Control.

Step 4

Click Save changes.

Step 5

On the Meraki dashboard, click on your username in the upper right corner of the screen and then click My Profile.

Step 6

Locate the API access header and clickGenerate new API key. Copy this API key. We recommend temporarily pasting it into a note until you are ready to use it. If you close the copy source before you paste the API key, you lose the copied API key.

Note

 

You only need one API key per device. You can re-onboard a Meraki device without generating a new key.
What to do next
Continue to Onboard a Meraki Device to Security Cloud Control.

Onboard an MX Device to Security Cloud Control

Use this procedure to onboard a Cisco Meraki device:

Before you begin
Generate and Retrieve Meraki API Key.
Procedure

Step 1

In the left pane, click Security Devices.

Step 2

Click the blue plus button and click the Meraki tile.

Step 3

Select the Secure Device Connector that this device will communicate with. The default SDC is displayed but you can change it by clicking the blue Change link.

Step 4

Paste the API access key you copied. If the key is incomplete or incorrect, you will not be able to onboard the device. Click Connect.

Step 5

Use the drop-down menu to select the correct Organization. The generated list of organizations are retrieved from the Meraki dashboard and includes devices and templates. Select the desired device and click Select.

Step 6

Use the drop-down menu to select the correct Network. The generated list of networks are retrieved from the Meraki network. Click Select.

Step 7

Optionally, you can add unique Labels for the device. You can later filter your list of devices by this label.

Step 8

Click Continue. The device beings the onboarding process. Once completed, Security Cloud Control redirects you to Security Devices.

Onboard Meraki Templates to Security Cloud Control

Meraki Templates are an excellent way to manage multiple locations or networks with a single policy. Meraki templates can be managed by both Security Cloud Control and the Meraki dashboard. Note that Security Cloud Control deploys configuration changes to the Meraki dashboard, which in turn deploys the configuration securely to the template. See How Does Security Cloud Control Communicate With Meraki for more information.


Note

To onboard a template to Security Cloud Control, you must first create a template in the Meraki dashboard. Without having access to the Meraki dashboard, your organization will not be recognized by the Meraki cloud and you will not be able to generate an API token to onboard your device. In the Meraki dashbaord, click Organization > Configuration templates and read Managing Multiple Networks with Configuration Templates for more information.

Onboarding a Meraki template requires three steps:

Procedure

Step 1

Create a template network in the Meraki dashboard. See Meraki Templates Best Practices for more information.

Step 2

Generate and retrieve a Meraki API key. When you onboard a Meraki template, you must generate a Meraki API key. The key authenticates the dashboard and allows you to securely onboard a device.

Step 3

Onboard a Meraki Template to Security Cloud Control using the key.

Generate and Retrieve Meraki API Key

Use this procedure to enable Security Cloud Control access to the Meraki dashboard with API access:

Procedure

Step 1

Log into the Meraki dashboard.

Step 2

In the navigation panel click Organization > Settings.

Step 3

Under Dashboard API Access, check Enable access to the Cisco Meraki Dashboard API. Without this option, you cannot generate API keys to onboard MX devices to Security Cloud Control.

Step 4

Click Save changes.

Step 5

On the Meraki dashboard, click on your username in the upper right corner of the screen and then click My Profile.

Step 6

Locate the API access header and click Generate new API key. Copy this API key. We recommend temporarily pasting it into a note until you are ready to use it. If you close the copy source before you paste the API key, you lose the copied API key.

Note

 

You only need one API key per template. You can re-onboard a template without generating a new key.

Onboard an Meraki Template to Security Cloud Control

Use the following procedure to onboard a Meraki template:

Procedure

Step 1

In the left pane, click Security Devices.

Step 2

Click the blue plus button and click Connect to Cisco Meraki.

Step 3

Paste the API access key you copied. If the key is incomplete or incorrect, you will not be able to onboard the device. Click Connect.

Step 4

Use the drop-down menu to select the template name as ab Organization. The generated list of organizations are retrieved from the Meraki dashboard and includes devices and templates. Select the desired template and click Select.

Step 5

Optionally, you can add unique Labels for the device. You can later filter your list of devices by this label.

Step 6

Click Continue. The device beings the onboarding process. Once completed, Security Cloud Control redirects you to Security Devices. Once the template is synched to Security Cloud Control, the Security Devices page displays the names of the devices associated with the template and the Device Details window of displays the number of networks bound to the template.

Update Meraki MX Connection Credentials

If you generate a new API key from the Meraki dashboard, you must update the connection credentials in Security Cloud Control. To generate a new key, see Generate and Retrieve Meraki API Key for more information. Security Cloud Control does not allow you to update the connection credentials for the device itself; if necessary, you can manually refresh the API key in the Meraki dashboard. You must manually update the API key in the Security Cloud Control UI to update the credentials and re-establish communication.


Note

If Security Cloud Control fails to sync the device, the connectivity status in Security Cloud Control may show "Invalid Credentials." If that's the case, you may have tried to use an API key. Confirm the API key for the selected Meraki MX is correct.

Use the following procedure to update the credentials for a Meraki MX device:

Procedure

Step 1

In the left pane, click Security Devices.

Step 2

Click the Devices tab and then click the Meraki tab.

Step 3

Select the Meraki MX whose connection credentials you want to update.

Step 4

In the Device Actions pane, click Update Credentials.

Step 5

Enter the API key Security Cloud Control uses to log into the device and click Update. Unless it was changed, this API key is the same credential you used to onboard the Meraki MX. You do not have to deploy these changes to the device.

Delete a Device from Security Cloud Control

Use the following procedure to delete a device from Security Cloud Control:

Procedure

Step 1

Log into Security Cloud Control.

Step 2

In the left pane, click Security Devices.

Step 3

Locate the device you want to delete and check the device in the device row to select it.

Step 4

In the Device Actions panel located to the right, select Remove.

Step 5

When prompted, select OK to confirm the removal of the selected device. Select Cancel to keep the device onboarded.