Cisco Security Cloud Control: Secure Firewall Management

Requirements: Prerequisites to use Policy Analyzer and Optimizer

Updated: October 16, 2026

Want to summarize with AI?

Outlines the prerequisites that apply to your policy type and data source before using Policy Analyzer and Optimizer.

General prerequisites

Before you use Policy Analyzer and Optimizer, verify the prerequisites that apply to your policy type and data source.

Integrate each On-Premises Firewall Management Center with Security Cloud Control.

Note

In the On-Premises Firewall Management Center, navigate to Integration > Cisco Security Cloud and check the Enable Policy Analysis & Optimization checkbox after integrating with the Cisco Security Cloud.

AgenticOps onboarding requirements

Policy Analyzer and Optimizer access depends on the customer state and whether onboarding is complete.


Customer and onboarding state	Policy Analyzer and Optimizer access	Required action
New customer and AgenticOps is not onboarded	Policy analysis and optimization are unavailable. Selecting the analysis action opens an AgenticOps onboarding prompt.	Onboard AgenticOps for the organization and the selected management center data source.
Existing customer during the grace period	Manual and scheduled analysis, existing results, and remediation history remain available. Security Cloud Control displays the deadline or remaining time.	Complete AgenticOps onboarding before the displayed deadline to prevent an interruption.
Existing customer after the grace period	New manual and scheduled analyses are blocked. Existing analysis and remediation data is retained.	Complete AgenticOps onboarding to restore policy analysis. You can onboard after the grace period ends.
AgenticOps is onboarded	Policy Analyzer and Optimizer analyzes supported policies and displays available results normally.	No onboarding action is required.

Management Center interface behavior

The management center interface determines where onboarding, grace-period, and blocked-state information appears.


Data source interface	During the grace period	After the grace period
Cloud-Delivered Firewall Management Center	Policy Analyzer and Optimizer remains available. A banner or onboarding action directs you to Security Cloud Control.	The interface displays an onboarding prompt and directs you to Security Cloud Control. New analysis is unavailable.
On-Premises Firewall Management Center Version 10.5 or later	The newer interface displays the AgenticOps banner and onboarding action while analysis remains available.	The interface displays the AgenticOps onboarding action. New analysis is unavailable.
On-Premises Firewall Management Center Versions 7.6 through 10.4.x	Analysis continues. Grace-period information appears after you cross-launch to Security Cloud Control.	The local interface can show Analysis changes pending in Last Analyzed and return a generic analysis error. Select the optimizable percentage to cross-launch and onboard AgenticOps.
On-Premises Firewall Management Center Versions 7.2 through 7.5.x	The management center has no local Policy Analyzer and Optimizer interface. Use Security Cloud Control to view policies and the grace-period information.	Use Security Cloud Control to review the onboarding requirement and onboard AgenticOps.

Access control policy prerequisites

Verify these access control policy requirements.

Access control policy analysis is supported on the On-Premises Firewall Management Center operating on Version 7.2 or later. The Cisco-recommended Version is 7.6 or later, because these versions support cross-launch to Policy Analyzer and Optimizer directly from On-Premises Firewall Management Center.
Access control policy to be analyzed must be associated with a Firewall Threat Defense device that is managed by an On-Premises Firewall Management Center integrated with Security Cloud Control.
The policy is synchronized to Security Cloud Control and appears on the Access Control page.

Network address translation prerequisites

Verify these NAT policy requirements: NAT policy analysis requires specific version requirements and AgenticOps enablement.

The On-Premises Firewall Management Center runs Version 7.6 or later.
NAT policy analysis is supported on the On-Premises Firewall Management Center operating on Version 7.6 or later. For more information, refer to Enable AgenticOps Insights.
AgenticOps is onboarded for the organization and the selected management center data source, or an existing-customer grace period is active.
Enable AgenticOps for the Cloud-Delivered Firewall Management Center or On-Premises Firewall Management Center data source that you want to analyze. Choose Insights & Reports > Settings > Policy Analyzer and Optimizer > Data Sources and enable AgenticOps for the management center you want.
The NAT rules to be analyzed are enabled. Policy Analyzer and Optimizer excludes disabled NAT rules.

If an On-Premises Firewall Management Center is running a version earlier than 7.6, access control Policy Analyzer and Optimizer may still be available for analyzing access control policy, but Network Address Translation Policy Analyzer and Optimizer is not available for that data source.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.