topic Re: How to migrate SFR policies and object on-the-box management to FMC? in Network Security

How to migrate SFR policies and object on-the-box management to FMC?

erickflamenco — Wed, 16 Dec 2020 20:49:03 GMT

Hi Experts,

How do I import a very huge Access-control Policy and a lot of objects, from SFR ASA5500x module with on-the-box management (ASDM) to Firepower Management Center FMC-ACP?

What´s you recommendation?

Thanks a lot for your response.

Erick

Re: How to migrate SFR policies and object on-the-box management to FMC?

benolyndav — Wed, 16 Dec 2020 21:42:21 GMT

You use the ASA to FTD migration tool which can be downloaded from Cisco.com.

Thanks

Re: How to migrate SFR policies and object on-the-box management to FMC?

balaji.bandi — Wed, 16 Dec 2020 22:25:27 GMT

If you looking to Migrate from SFR to FTD follow the below guide : ( you need to register the SFR device with FMC first)

https://www.cisco.com/c/en/us/support/docs/security/firepower-management-center/213269-upgrade-procedure-through-fmc-for-firepo.html

Re: How to migrate SFR policies and object on-the-box management to FMC?

erickflamenco — Wed, 16 Dec 2020 22:46:44 GMT

Hi MassB

This tool is for ASA configuration not for sfr configuration.

ASA 5585-X with ASA only (the Firepower Migration Tool does not migrate the configuration from the ASA FirePOWER module)

Thanks

https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide/ASA2FTD-with-FP-Migration-Tool/b_Migration_Guide_ASA2FTD_chapter_0111.html#id_70647__Target

Re: How to migrate SFR policies and object on-the-box management to FMC?

erickflamenco — Wed, 16 Dec 2020 22:49:01 GMT

Hi Balaji,

I´m not looking for upgrading the module, I´m looking for migration ACP and objects from on-box fo FMC.

Thanks.

Re: How to migrate SFR policies and object on-the-box management to FM

Spyros Kasapis — Sun, 06 Feb 2022 10:01:17 GMT

Did you find anything ?

Re: How to migrate SFR policies and object on-the-box management to FM

Marvin Rhoads — Sun, 06 Feb 2022 12:18:07 GMT

@Spyros Kasapis there is no tool to migrate policies etc. from a locally-managed ASA Firepower service module to FMC.

The only option is to manually recreate them.

Re: How to migrate SFR policies and object on-the-box management to FM

Spyros Kasapis — Sun, 06 Feb 2022 12:42:08 GMT

Thank you Marvin .

Re: How to migrate SFR policies and object on-the-box management to FM

Marius Gunnerud — Sun, 06 Feb 2022 13:14:51 GMT

Just to add to what Marvin has said, you could look into writing a script, using APIs, that gets the configuration from the FDM, converts the rule to be FMC compatible and then POST to the FMC. Still a manual process but it will reduce human error.

Re: How to migrate SFR policies and object on-the-box management to FM

Spyros Kasapis — Sun, 06 Feb 2022 13:20:40 GMT

Hello Marius ,

the rules are from srf not fdm .

Can you suggest a link to read ?

Re: How to migrate SFR policies and object on-the-box management to FM

Marius Gunnerud — Sun, 06 Feb 2022 13:50:08 GMT

Sorry overlooked that this was SFR. I did find this document on migrating ASA with SFR to FTD. Hope it helps.

https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide-fps/ASA2FTD-with-FPS-FP-Migration-Tool/b_Migration_Guide_ASA2FTD_chapter_0111.html