Explains how to migrate Firewall Threat Defense devices from On-Premises Firewall Management Center to Security Cloud Control while preserving policies, configurations, and settings through Security Cloud Control Firewall Management.

Firewall Threat Defense migration to Security Cloud Control is a feature that

enables organizations to move device management from on-premises infrastructure to Cisco's cloud-based management through Security Cloud Control,
migrates Firewall Threat Defense devices from On-Premises Firewall Management Center to Security Cloud Control, and
preserves existing policies, objects, and configurations during the migration process.

Customer benefits

This migration provides these benefits:

Preserves existing policies and configuration
Imports device-specific configuration, including interfaces, routing, and related settings
Handles duplicate policy and object names according to defined conflict-resolution rules
Transfers feature licenses automatically
Supports high availability pairs and clusters
Provides 14-day evaluation window before permanent commit
Allows analytics to remain on-prem or move to cloud
Provides an intuitive troubleshooting page with status summaries and step‑by‑step progress to pinpoint issues.
Provides migration reports for validation and audit

The user roles of the On-Premises Firewall Management Center are no longer applicable in Security Cloud Control after migration. Your authorization to perform tasks on the migrated device is based on your user role in Security Cloud Control. See the Users topic to understand the On-Premises Firewall Management Center Center and Security Cloud Control user role mapping.

Evaluation period and manager changes

An evaluation period is a migration assessment phase that

provides 14 days to test and assess migration changes using Security Cloud Control
allows you to undo changes and continue managing the device with On-Premises Firewall Management Center or commit migration changes manually, and
automatically commits changes after the evaluation period expires if no manual action is taken.

Evaluation period phases

The evaluation period consists of three distinct phases with specific capabilities and restrictions.

After successful migration, you have these options:

Evaluate configuration for 14 days.
Undo the changes and continue managing the device with On-Premises Firewall Management Center.
Commit migration changes to Cloud-Delivered Firewall Management Center.

During the evaluation window, these restrictions apply:

High availability break may not be supported (depending on onboarding method).
Advanced high availability or cluster operations can cause commit failure. Commit before changing HA or cluster configuration.
Deleting devices is not allowed.
Changes made in Cloud-Delivered Firewall Management Center are lost, if reverted.
Do not create or modify domains or subdomains on the On-Premises Firewall Management Center if the domain change includes a Firewall Threat Defense device that was migrated to Security Cloud Control. Commit the migration changes in Security Cloud Control, or revert device management to the on-premises On-Premises Firewall Management Center, before you make domain changes that include the migrated device.

If you create or modify a domain before the migration job is committed, deployment of the device and domain configuration can fail. You can continue to create or modify domains on the On-Premises Firewall Management Center for devices that remain managed by that On-Premises Firewall Management Center and are not part of an uncommitted migration job.

After the evaluation period expires, these conditions apply:

Changes are automatically committed.
Selected commit actions cannot be revoked.ß

How Firewall Threat Defense licenses are handled during migration

Firewall Threat Defense license handling during migration is a process that

transfers all feature licenses associated with the device to Security Cloud Control and releases them from the Firewall Management Center to the Smart License pool
enables the device to reclaim device-specific licenses during its registration with Security Cloud Control, and
does not require device-specific licenses if devices remain in the Firewall Management Center for analytics only.

License handling details

You need not apply license on the device again after migration, as the license reclamation process occurs automatically during registration.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.