topic Re: ASA to FTD Migration in Network Security

ASA to FTD Migration

akash.tiwari — Tue, 25 May 2021 02:37:13 GMT

Dear Team,

Software Version

-ASA 5516X-9.9

-FTD(2140)-6.6

-FMC-6.6

-Migration Tool:2.3.5

Could you please help me out on below queries ?

-is SSL VPN or AnyConnect VPN is supported during Migration from ASA to FTD

-is SSL VPN's Object, NAT, ACL,certificates migrate ?

Re: ASA to FTD Migration

Rob Ingram — Tue, 25 May 2021 08:16:58 GMT

@akash.tiwari

It doesn't appear that you can currently migrate RAVPN settings. A list of supported migrated features is here

https://www.cisco.com/c/en/us/td/docs/security/firepower/migration-tool/migration-guide/ASA2FTD-with-FP-Migration-Tool/ASA2FTD-with-FP-Migration-Tool_chapter_0111.html

From your lsit can migrate objects, NAT, access-lists. You should be able to manually export the certificates from the ASA and import to the FMC. Example.

HTH

Re: ASA to FTD Migration

Marvin Rhoads — Tue, 25 May 2021 07:52:45 GMT

You can export CA certificates but not generally identity certificate - that requires the device's private key to be usable.

I get the issuing CA to rekey the certificate based on either new CSR generated from FTD or one I generate from XCA. The latter is preferable so that I can combine the issued certificate with the private key and the certificate chain into FMC.