Cisco Security Cloud Control: Secure Firewall Management

Review and manage Firewall Threat Defense migration job

Updated: October 16, 2026

Want to summarize with AI?

Configure review and management of Firewall Threat Defense migration job status in Security Cloud Control, including device progress monitoring, evaluation-period actions, report downloads, and deployment issue resolution.

Use this task to effectively monitor and manage Firewall Threat Defense migration jobs, track device migration progress, handle evaluation period activities, and resolve deployment or identity policy issues that may arise during the migration process.

The migration dashboard provides the status of all migration jobs initiated from the Security Cloud Control. You can expand a specific job to see the status of individual devices associated with that tenant. This helps you keep track of the progress of your migration and identify issues, if any, that need to be addressed.

When a migration job is successful, you have 14 days to test and assess migration changes. If you are convinced about the migration changes, we recommend that you commit the devices manually, and not wait for Security Cloud Control to automatically commit the migration changes.

Procedure

Check migration job status in the migration dashboard.
If you have set up alerts for device workflows, click the notifications icon to see the alerts that have been triggered during the migration process. Additionally, if you have opted to receive email notifications from Security Cloud Control, you will also receive an email notification regarding alerts, if any.

Review the following information for each migration job:
- Name: Represents the job name that shows the On-Premises Firewall Management Center name and the date and time when the job was initiated.
- Number of FTDs: Shows the total number of devices that are being migrated to the cloud.
- Status: Shows the status of the job. Expand the job to see the status of individual devices.
- Last Update: Shows the date and time that are updated only when a change is made to the device.
Manage migration job actions using the Actions menu.
Click to execute the following actions:
- Workflows: Takes you to the Workflows to monitor the job. See Monitor workflows in Security Cloud Control.
- Download Report: Allows you to generate and download a report of every job that is completed successfully. See Generate a migration report.
- Commit Manager Changes: Allows you to apply the changes manually to devices before the evaluation period ends. See Commit migration changes manually to Security Cloud Control.
- Remove Migration Job: Allows you to remove a completed job. Link is available only for completed jobs. See Remove a completed migration job.
Monitor deployment status and address validation issues.

After a successful migration, Security Cloud Control deploys the configuration to the device. If the system identifies errors or warnings in the changes to be deployed, it displays them in the Validation Messages window. To view complete details, click the arrow icon before the warnings or errors. If the deployment fails, see the Best Practices for Deploying Configuration Changes section of Firepower Management Center Device Configuration Guide X.Y.
Configure realm sequence for identity policy if required.

If the device contains an identity policy with a Realm or ISE configuration, configure your device as a proxy for Security Cloud Control to communicate with the identity source. The identity policies don't function if Security Cloud Control fails to connect to the Identity Realms.

A tooltip appears in the Status column for a device that requires additional configuration.
1. Click the tooltip icon and then click Learn more.
2. In the Configure Proxy window, click Configure my realms.
  
  To add a proxy sequence, see the Create a Proxy Sequence section in the Firepower Management Center Device Configuration Guide, 7.2.
Commit migration changes if satisfied with the evaluation.
When a job is completed successfully, the FTD Migration job is successful message appears in the Status column. You can click the tooltip to see the number of days remaining for evaluating the manager.

You can click Commit Migration Changes to commit the changes manually before the 14 days evaluation period ends.
Note
- You cannot revoke the actions that are specified in the migration commit window after committing the changes.
- You can cancel the migration during the evaluation period and return the device to the On-Premises Firewall Management Center.
- You cannot delete a device from either the On-Premises Firewall Management Center or Cloud-Delivered Firewall Management Center during the evaluation period.
Changes can be made and deployed to the device using Security Cloud Control during the evaluation period. If you switch device management back to the On-Premises Firewall Management Center, Security Cloud Control-specific changes made during the evaluation period is not saved on the device once it is reverted to the source Security Cloud Control tenant. You must deploy the changes from the On-Premises Firewall Management Center to the device after reverting the device's manager.

You have successfully reviewed and managed the Firewall Threat Defense migration job. The migration status is monitored, any deployment issues are addressed, identity policy configurations are updated as needed, and migration changes are committed or cancelled based on your evaluation.

Note that for the On-Premises Firewall Management Center 1000/2500/4500, you would have migrated devices from Version 7.4, which is unsupported for general operations. To return the On-Premises Firewall Management Center to a supported version you must remove the re-migrated devices, reimage back to Version 7.2.x, restore from backup, and re-register the devices.

Proceed migration process

This task resumes a paused migration process to complete the import of device-specific configurations and register devices with Security Cloud Control.

If the Pause migration to review imported shared policies option was checked during the migration setup, the migration process will pause after the shared access policies were staged in the Security Cloud Control. After you've reviewed the staged configurations, you must manually instruct Security Cloud Control to resume the migration, which will then import device-specific configurations such as routing and interfaces, as well as register the Firewall Threat Defense with the Security Cloud Control. Completion of the migration triggers a 14-day evaluation period.

Procedure

Go to the migration job page and click Proceed with migration for the relevant job.

The migration process resumes and completes the import of device-specific configurations and registration with Security Cloud Control. A 14-day evaluation period begins upon completion.

What to do next

Remember that deployment from the Security Cloud Control must be done after a successful migration.

Commit migration changes manually to Security Cloud Control

This task enables you to manually commit Firewall Threat Defense migration changes to Security Cloud Control when you are confident in your changes and do not want to wait for automatic commit.

We recommend that you commit migration changes manually if you are convinced with your changes and not waiting for Security Cloud Control to auto commit changes. The Commit Migration Changes window shows the remaining days to commit the migration to Security Cloud Control or revert the device to On-Premises Firewall Management Center. During the evaluation period, you can modify the actions for selected threat defense devices before committing the changes. Once the changes are committed, you can't revoke the actions.

Note

The commit manager changes actions are disabled in the following conditions:

The 14-day evaluation period has passed.
The Firewall Threat Defense devices have either been reverted to the On-Premises Firewall Management Center or deleted from On-Premises Firewall Management Center, in which case, no further actions can be taken.

Procedure

In the migration jobs page, click the under the Actions column of a completed job.
Click Commit Migration Changes.

This link is available only after a job is completed successfully.
Select a device and in the Commit Actions list, choose one of the following actions:
- Retain on OnPrem FMC for Analytics: After committing the changes, analytics management for selected Firewall Threat Defense devices is retained on the management center.
- Delete Firewall Threat Defense from OnPrem FMC: After committing the changes, the selected devices are removed from the On-Premises Firewall Management Center and are available for Security Cloud Control to handle the analytics. You must configure the Firewall Threat Defense to send events to Security Cloud Control for managing analytics. After the Firewall Threat Defense devices are deleted from the On-Premises Firewall Management Center, they cannot be revoked.
Note

If you want to revert the device management to On-Premises Firewall Management Center, refer to Revert manager ownership to On-Premises Firewall Management Center.
Click Commit executes your specified actions immediately without further confirmation.

On the migration jobs screen, you can expand the job to check the progress of the actions specified.

The migrated devices appear on Security Cloud Control's Security Devices page. These devices can be managed using the Cloud-Delivered Firewall Management Center portal that is linked to Security Cloud Control. Ensure you deploy the changes to the devices from Cloud-Delivered Firewall Management Center.

Migration changes are committed to Security Cloud Control with the selected analytics ownership actions applied. The migrated devices become available for management through Security Cloud Control.

Revert manager ownership to On-Premises Firewall Management Center

This task reverts Firewall Threat Defense device management to the original On-Premises Firewall Management Center during the evaluation period, allowing you to discontinue management through the Security Cloud Control platform.

You can revert the device management to the On-Premises Firewall Management Center during the evaluation period. This means that the devices will no longer be managed through the Security Cloud Control platform. However, it is important to note that any changes made during the migration process in the Security Cloud Control will not be reflected in the On-Premises Firewall Management Center after reverting Firewall Threat Defense management.

Note

When the Firewall Threat Defense management has been returned to the On-Premises Firewall Management Center, you can begin the migration job again to switch the Firewall Threat Defense management to Security Cloud Control.

Procedure

In the migration jobs page, click the under the Actions column of a completed job.
Click Commit Migration Changes.

This link is available only after a job is completed successfully.
Select a device and in the Commit Actions list, choose Revert Manager to OnPrem FMC.
Click Commit executes your specified actions immediately without further confirmation.
Deploy the changes to the device from the On-Premises Firewall Management Center.

The device management is reverted to the On-Premises Firewall Management Center and the device is no longer managed through the Security Cloud Control platform.

View migrated devices and analytics-only entries

This task allows you to view and distinguish between configuration-managed and analytics-managed device instances after migration.

The migrated devices appear on the Security Devices page in Security Cloud Control. You can cross-launch and configure the required feature on the Cloud-Delivered Firewall Management Center.

Note

The devices on the Cloud-Delivered Firewall Management Center device listing page may show No-IP instead of the device's management IP address. Because the device registration uses the NAT ID, the device initiates the process, and therefore, the management IPs aren't discovered or used for the connection. Note that this applies to newly onboarded devices and devices migrated from the On-Premises Firewall Management Center.

Procedure

Navigate to the Security Devices page to view migrated devices.

Security Cloud Control creates two instances of the same device that is configured to retain on the Firewall Management Center for analytics.

The device instance with FMC FTD and Analytics Only labels shows that the Firewall Management Center handles the analytics. The device instance with the FTD label indicates that Security Cloud Control manages its configuration.
Select the device having FTD label and in the Management pane on the right, click Device Summary.

You can manage the configuration of the device using Security Cloud Control. This will show the device in the Cloud-Delivered Firewall Management Center.
To view events from the device, select the device having FMC FTD and Analytics Only labels and on the right, click the Manage Devices link.
Log on to the on premise Firewall Management Center.
Choose Device > Device Management.

You can't select this device as Security Cloud Control manages the configuration. The Firewall Management Center shows the Security Cloud Control Managed label for this device.
To see the live events in the Firewall Management Center, click Analysis > Events.

You can now view and distinguish between migrated devices and analytics-only entries, access device summaries for configuration-managed instances, and view live events from analytics-only instances.

Generate a migration report

Generate and download a PDF migration report to review imported settings after a successful migration job. The report provides comprehensive details about device configurations, shared-policy values, objects, routing, interfaces, network settings, and other imported parameters.

After completing a migration job from On-Premises Firewall Management Center to Security Cloud Control, you can access a detailed report that documents all imported configurations. This report is available for download within one year of job completion and serves as a reference for reviewing the migration results.

Procedure

On the migration jobs page, click the under the Actions column of a completed job.
Click Download Report.

You must download the report within a year after the job starts.

A PDF report downloads containing device details, shared-policy values, objects, routing, interfaces, network settings, and other imported parameters from the migration job.

Remove a completed migration job

Remove a completed migration job to clean up the migration page and make it easier to navigate when the job is no longer needed.

Remove a job only after it is no longer needed. This cleans up the migration page and make it easier to navigate.

If you want to delete a migration job during the evaluation period, you must first commit the migration changes or revert the manager to the on-prem management center. Failing to do so may result in an inconsistent state of the on-prem management center, which could be unrecoverable. See Commit Migration Changes Manually.

If you don't have access to your On-Premises Firewall Management Center or if it is no longer available and you are blocked from performing a commit or revert, you can delete the job.

Procedure

From the Security Cloud Control Home page, click Firewall.
Click Administration > Migration > Migrate FTD to cdFMC.
Click the under the Actions column and then click Remove Migration Job.
Click Delete to confirm your action.

The migration job is removed from the migration page, making the job list cleaner and easier to navigate.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.