Device connectivity planning

Device connectivity planning is a network architecture consideration that

determines whether Security Cloud Control Firewall Management connects to managed devices through the cloud connector or through an SDC
requires specific network access permissions based on the connection method, and
depends on device type and internet accessibility requirements.

Connection methods and requirements

The connection method depends on device internet accessibility and organizational requirements.

Device connection methods
Connection method	Use when	Required network access
Direct cloud connector	The device is directly reachable from the internet.	Allow inbound access from the Security Cloud Control Firewall Management IP addresses for your cloud region on port 443, or on the port that you use for device management.
SDC	The device is not directly reachable from the internet, or the source explicitly requires an on-premises SDC.	Allow full inbound access from the SDC host on port 443, or on the port that you use for device management. Ensure that the SDC VM can reach the device management interface.

An FDM-managed device can be onboarded to Security Cloud Control Firewall Management by using device credentials, a registration key, or its serial number whether it is directly accessible from the internet. If the device does not have direct internet access, but it resides on a network that does, the Security Services Exchange connector that is delivered as part of the device can reach the Security Services Exchange cloud and allow the FDM-managed device to be onboarded.

The source explicitly states that you need an on-premises SDC to onboard these devices:

An ASA device that is not accessible from the cloud
An FDM-managed device that is not accessible from the cloud when you use the credentials onboarding method
A Cisco IOS device
A device with SSH access

All other devices and services do not require an on-premises SDC because Security Cloud Control Firewall Management connects by using its cloud connector.

Docker network considerations for the SDC

SDC runs as a Docker container. Docker commonly uses the 172.17.0.0/16 subnet for the default bridge network, docker0.

If 172.17.0.0/16 , or any part of the Docker-assigned network space, overlaps with your existing network IP space, change the Docker network defaults before deploying the SDC. To use alternate networks, edit /etc/docker/daemon.json configuration.

For example, Use the supernet 10.198.0.1/24 for Docker networking address pools and use IP address 10.198.128.0/17 as the default docker bridge interface, docker0, from the subnet 10.198.0.0/24 .

sudo vi /etc/docker/daemon.json

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "100m",
    "max-file": "5"
  },
    "bip": "10.198.0.1/24",
    "default-address-pools": [
        {
            "base": "10.198.128.0/17",
            "size": 24
        }
    ]
}

(save and exit)

sudo reboot (required)

For more information, see Networking overview.