Cisco Security Cloud Control: Cisco Meraki Management

Create a Local Meraki Network Object

Updated: July 12, 2026

Want to summarize with AI?

Learn how to create local Meraki network objects in the Meraki dashboard and synchronize them into Security Cloud Control as read-only FTD network objects or object groups.

A local Meraki network object must be made in the Merkai dashboard. If you have a Meraki device that has not been onboarded to Security Cloud Control yet, any pre-existing local objects are onboarded with the device; if you have a Meraki device that has been onboarded, sychronize the device in Security Cloud Control to read the new configuration and local objects.

Note

Once a device configuration referencing a Meraki network object or network object group is onboarded or synchronized with the Security Cloud Control UI, these objects are displayed as FTD Network objects or object groups.

These objects and object groups are read-only in Security Cloud Control.

Before you begin

If you have not enabled Merkai's Open Beta Network Objects, log into the Meraki dashboard and navigate to Organization > Policy Object to enroll and get access to local objects and object groups

Procedure

	1.	Log into the Meraki dashboard and create a local object or a local object group. See the Meraki Network Objects Configuration Guide for more information.
	2.	Log into Security Cloud Control. Note: If you have not yet onboarded your Meraki device to Security Cloud Control, see Onboard an MX Device to Security Cloud Control for more information. Onboarding a device also onboards all the pre-existing objects.
	3.	In the left pane, click Security Devices.
	4.	Locate the Merkai device and select it so the device row is highlighted. The device status is Conflict detected. In the pane located to the right, select either Review Conflict to review the changes made to the device's configuration or Accept without Review to accept all configuration changes.

Create or Edit a Meraki Network Object or Network Group

MX devices use the same format as Firepower and ASA network objects and can contain a host name, an IP address or a subnet address expressed in CIDR notation. Network groups are a collection of network objects and other individual addresses or subnets you add to the group. Network objects and network groups are used in access rules. You can create, read, update, and delete network objects and network groups using Security Cloud Control.

IP addresses that can be added to network objects


Device type	IPv4 / IPv6	Single Address	Range of addresses	Fully Qualified Domain Name	Subnet using CIDR Notation
MX	IPv4	Yes	Yes	No	Yes

Note

If Cloud-Delivered Firewall Management Center is deployed on your tenant:

When you create an FTD, FDM, or ASA network object or group on the Objects page, a copy of the object is automatically added to the Cloud-Delivered Firewall Management Center and vice-versa. In addition, an entry is created in the Devices with Pending Changes page for each on-premises Firewall Management Center with Discover & Manage Network Objects enabled, from which you can choose and deploy the objects to the on-premises Firewall Management Center on which you want these objects.

Note

If Cloud-Delivered Firewall Management Center is deployed on your tenant:

Changes you make to the ASA, FDM, and FTD network objects and groups are reflected in the corresponding Cloud-Delivered Firewall Management Center network object or group. In addition, an entry is created in the Devices with Pending Changes page for each on-premises Firewall Management Center with Discover & Manage Network Objects enabled, from which you can choose and deploy the changes to the on-premises Firewall Management Center on which you have these objects.

Deleting a network object or group from either page deletes the object or group from both pages.

Create a Meraki Network Object

Note

If Cloud-Delivered Firewall Management Center is deployed on your tenant:

When you create an FTD, FDM, or ASA network object or group on the Objects page, a copy of the object is automatically added to the Cloud-Delivered Firewall Management Center and vice-versa. In addition, an entry is created in the Devices with Pending Changes page for each on-premises Firewall Management Center with Discover & Manage Network Objects enabled, from which you can choose and deploy the objects to the on-premises Firewall Management Center on which you want these objects.

Procedure

	1.	From the Security Cloud Control Home page, click Firewall.
	2.	In the left pane, click Objects.
	3.	Click , then click FTD > Network or ASA > Network.
	4.	Enter an object name.
	5.	Select Create a network object.
	6.	In the Value section, enter a single IP address or a subnet address expressed in CIDR notation.
	7.	Click Add.
	8.	Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Create a Meraki Network Group

A network group is made up of multiple network objects or IP addresses.

If you want your network group to be made up of network objects, use the "Create a Network Object" procedure above to create individual network objects for your IP addresses.

Note

If Cloud-Delivered Firewall Management Center is deployed on your tenant:

When you create an FTD, FDM, or ASA network object or group on the Objects page, a copy of the object is automatically added to the Cloud-Delivered Firewall Management Center and vice-versa. In addition, an entry is created in the Devices with Pending Changes page for each on-premises Firewall Management Center with Discover & Manage Network Objects enabled, from which you can choose and deploy the objects to the on-premises Firewall Management Center on which you want these objects.

Procedure

	1.	From the Security Cloud Control Home page, click Firewall.
	2.	In the Security Cloud Control navigation bar on the left, click Objects.
	3.	Click , then click either FTD > Network or ASA > Network.
	4.	Enter an object name.
	5.	Select Create a network group.
	6.	Click Add Object, select the network object from the list and click Select. Continue to do this until you have added all the network objects you want.
	7.	Click Add.
	8.	Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Edit a Firepower Network Object or Network Group

Note

If Cloud-Delivered Firewall Management Center is deployed on your tenant:

Changes you make to the ASA, FDM, and FTD network objects and groups are reflected in the corresponding Cloud-Delivered Firewall Management Center network object or group. In addition, an entry is created in the Devices with Pending Changes page for each on-premises Firewall Management Center with Discover & Manage Network Objects enabled, from which you can choose and deploy the changes to the on-premises Firewall Management Center on which you have these objects.

Deleting a network object or group from either page deletes the object or group from both pages.

Procedure

	1.	From the Security Cloud Control Home page, click Firewall.
	2.	In the left pane, click Objects.
	3.	Locate the object you want to edit by using object filters and search field.
	4.	Select the object you want to edit.
	5.	Click the edit button in the details pane.
	6.	Edit the values in the dialog box in the same fashion that you created them in the procedures above.
	7.	Click Save.
	8.	Security Cloud Control displays the policies that will be affected by the change. Click Confirm to finalize the change to the object and any policy affected by it.
	9.	Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Deleting Network Objects and Groups in Security Cloud Control

If Cloud-Delivered Firewall Management Center is deployed on your tenant:

Deleting a network object or group from the Objects page deletes the replicated network object or group from the Objects page on the Cloud-Delivered Firewall Management Center and vice-versa.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.