topic Hi Marvin, in Network Security

ASA to FTD migration tool

seegomaa — Fri, 21 Feb 2020 14:02:31 GMT

Hello All,

I'm in trying to convert ASA configuration file to FTD but gettingbelow error on FMC virtual

Error

Invalid ASA configuration file! Please pass a valid file.

I'm following Cisco guide I installed FMC virtual on VMWare and trying to upload the ASA configuration to convert it but stuck in the upload package step. ASA configuration file is .txt and ASA version is 9.2

I've only heard of one or two

Marvin Rhoads — Tue, 28 Mar 2017 12:56:30 GMT

I've only heard of one or two people trying out the migration tool and they were not happy with the experience.

I doubt you will get much input on your issue on the forums - I'd suggest going straight to a TAC case to save time.

Hi Marvin,

seegomaa — Tue, 28 Mar 2017 12:59:54 GMT

Hi Marvin,

The issue her is i'm using a virtual FMC in my lab as recommended by cisco so will they accept supporting this virtual FMC.

You're right - labs and NFR

Marvin Rhoads — Tue, 28 Mar 2017 13:04:00 GMT

You're right - labs and NFR gear can be challenging in that respect.

Do you have a target FTD device or FMC for this "migration" that's under support? That would work.

I have production FMC under

seegomaa — Tue, 28 Mar 2017 13:10:42 GMT

I have production FMC under support.

I found the issue. the line

seegomaa — Tue, 28 Mar 2017 17:45:58 GMT

I found the issue. the line highlighted in blue was missing !!!. I don't understand why the tool gives error with such line.

: Saved

: Serial Number: *********

: Hardware: ASA5585-SSP-20, 12288 MB RAM, CPU Xeon 5500 series 2133 MHz, 1 CPU (8 cores)

: Written by admin at 06:37:47.509 UTC Thu Jan 5 2017

ASA Version 9.2(4)

hostname xxxxxx

domain-name xxx.xxx

after importing configuration

seegomaa — Wed, 29 Mar 2017 07:58:30 GMT

after importing configuration file to production FMC i don't understand interface groups. I used to assign one interface to a zone earlier. but interface group is new for me.

can anyone explain what is interface groups vs zone.

Thank you

Are object which can be used

Claudiu Cismaru — Sat, 01 Apr 2017 18:17:01 GMT

Are object which can be used in ACP rules or wherever it requires to add an interface.

Hey Mate,

prashant dwivedi — Tue, 18 Apr 2017 07:22:40 GMT

Hey Mate,

did you get your migration worked well ?

I am in the process of same migration, can you able to share your experience and any special consideration that I many to think about. I mostly have ACLs in .. how did you deal with interface group and zoning ?

Hi Prashant,

seegomaa — Tue, 18 Apr 2017 10:55:06 GMT

Hi Prashant,

I didn't get any clear clarifications on zones vs interface groups so I ignored interfaces groups. i used only zones and removed all interfaces from interface groups. All my ACL and NAT are mapped to security zones only. Last Friday we migrated to FTD and it worked perfectly.

Please access cli and verify that the configuration is being pushed from FMC to FTD and you can take copy of the configuration also from the cli and compare it to your old ASA.

Please also try to use Packet trace in advanced troubleshooting tab to check which access rule and NAT rule your traffic will match before you migrate

Make sure you assign the ACP and NAT to the device.

Still i have one question searching for answer. In ASA to allow internal users to communicate with dmz servers we had to use NAT 0 or nat to the same ip. Do we still need to add such rules in the FTD ? all these rules already migrated and not sure what will happen if i remove them.

all the best.

An interface can only be

Alexander Hartmaier — Tue, 18 Apr 2017 15:41:55 GMT

An interface can only be assigned to a single zone but to multiple interface groups enabling much more flexibility.

Hello seegomaa. Thanks for

#Mat — Tue, 18 Apr 2017 23:00:38 GMT

Hello seegomaa. Thanks for your post, in a few days I have to work with same migration.

Did you first convert ASA to FTD and then connected FTD to FMC?
How did you import ASA's configuration on the FTD?

What guide did you use?

I would be grateful for any help you are able to provide.

Thanks!

You can use Virtual FMC to

prashant dwivedi — Wed, 19 Apr 2017 01:41:46 GMT

You can use Virtual FMC to convert ASA config to a format that can be directly uploaded into production FMC. However , for this your existing ASA should be running with the code 9.1 and above ( as per cisco docs).

You need to first connect FTD to your FMC in order to make any changes,HTH

Security -zone is similar to

prashant dwivedi — Wed, 19 Apr 2017 01:45:39 GMT

Security -zone is similar to name-if, you need to apply ACL to a security zone, the same we have been doing to name-if ( inteface name).

Also, multiple interfaces can be the part of same security zone ( not sure if there is any limit) , this will ensure that same policies will be applied to all the interfaces participaiting in the same security-zone.

However, when we migrate ASA to FTD, it make sense to have 1 to 1 mapping between your ASA interfaces ( name-if) and the security zones . Let me know if anyone has other thought.

Hey Seegomma, thanks for your

prashant dwivedi — Wed, 19 Apr 2017 04:30:20 GMT

Hey Seegomma, thanks for your reply.

So you used one security zone for each of interfaces on your existing ASA?

Can you please confirm if you have applied new ACLs under pre-filter or access control policy? Do we also need to worry about security level as this is with existing devices that allows all traffic from higher to lower level?

What command did you use to check the policies at the new FTD devices?

I don’t think there is auto-nat feature on FTD hence I Don’t see any need of configuring a NAT 0 or identity NAT for your traffic going from inside to DMZ segments. Your new FTD is running in cluster layer 2 mode ?

Hi Prashant,

seegomaa — Wed, 19 Apr 2017 04:30:21 GMT

Hi Prashant,

So you used one security zone for each of interfaces on your existing ASA?

Yes

Can you please confirm if you have applied new ACLs under pre-filter or access control policy?

ACL is applied under ACP .

There is no security levels in the FTD. if there is no ACL match, default action in the bottom will apply.

Your new FTD is running in cluster layer 2 mode ?

FTD is running in HA. Firewall is running routed mode.

could you please clarify what do you mean by Layer 2 mode ?

this is my email you can contact me: mohamed.gbm@gmail.com

Hi ortiz

seegomaa — Wed, 19 Apr 2017 04:40:42 GMT

Hi ortiz

As prashant mentioned, you need to use Lab virtual FMC. never use the production FMC for configuration conversion because once you use it for conversion you can revert it back and disable the conversion tool ( anyone correct if mistaken please)

Did you first convert ASA to FTD and then connected FTD to FMC?

Please note that there are two different FMCs here, your production FMC which you will connect FTD to and lab FMC which will be used to convert ASA configuration.

How did you import ASA's configuration on the FTD?

I followed cisco guide

http://www.cisco.com/c/en/us/td/docs/security/firepower/620/asa2ftd-migration/asa2ftd-migration-guide-620/asa2ftd_intro.html

simply take copy of ASA configuration then enable the tool on your lab FMC, then import ASA configuration. FMC will convert it then export it and import it to your production FMC

Thanks seegomaa and prashant

#Mat — Wed, 26 Apr 2017 00:32:00 GMT

Thanks seegomaa and prashant dwivedi ! You help me a lot with these notes.

Kind Regards.-

I just have the same issue. I

karthik.b4055 — Wed, 26 Apr 2017 07:03:39 GMT

I just have the same issue. I tried to add " Written by admin at 06:37:47.509 UTC Thu Jan 5 2017 " at the exact same place in my config file as follows :

: Saved

:
: Serial Number:
: Hardware: ASA5515, 8192 MB RAM, CPU Clarkdale 3058 MHz, 1 CPU (4 cores)
: Written by admin at 06:37:47.509 UTC Thu Jan 5 2017

!
ASA Version 9.5(3)
!

It still says invalid ASA configuration file. Please Advise!!!!!!

thanks in advance.

Hi Marvin,

khanquisher — Wed, 26 Apr 2017 11:21:37 GMT

Hi Marvin,

I am uploading FWSM file to FMC migration tool but its not accepting, dose anyone has migrate FWMS file here.