topic Re: Two ASA migration to Firepower in Network Security

Two ASA migration to Firepower

Antonio Macia — Tue, 12 Mar 2019 14:04:31 GMT

Hello,

My customer wants to consolidate two ASAs in one high-end Firepower appliance. I've successfully done one-to-one ASA to Firepower migrations in the past and for this case, I wanted to do the trick of consolidating both ASA configuration into one single configuration file. For that I took the relevant configurations which are interfaces, objects, groups and ACLs.

The process works fine but at some point it returns a UTF-8 conversion error, so seems that the trick doesn't work.

Wondering if could be possible to import the secondary ASA configuration in Firepower without overwriting the existing Firepower config. Like appending the new interfaces and objects.

Regards.

Re: Two ASA migration to Firepower

Abheesh Kumar — Wed, 07 Nov 2018 19:12:01 GMT

Hi Antonio,

I have did this same for one customer, manually merge both the configurations (object-groups, ACL, NAT, Access-group) into a single file and did the conversion with FMC migration tool (not the latest ASA to FTD migration tool). Only thing you need to manually configure the interfaces and routes in FMC as per the existing ASA. I have faced lot of issues with the new migration tool.

If you have a temporary vFMC then convert it to migration tool and upload the merged config file this will work like a charm.

HTH

Abheesh

Re: Two ASA migration to Firepower

Antonio Macia — Thu, 08 Nov 2018 11:53:08 GMT

Thanks Abheesh, good to know that someone was successful on doing the same. I managed to fix the issue with the encoding. I will let you know.

Regards.

Re: Two ASA migration to Firepower

Antonio Macia — Tue, 13 Nov 2018 09:36:14 GMT

For anyone interested, the procedure worked. Since I was consolidating a couple of existing firewalls on the same organization many objects were duplicated and I have to employ a Python script to remove the duplicates prior to run the migration tool.