topic Possible to move standalone FTD to be managed by FMC? in Network Security

Possible to move standalone FTD to be managed by FMC?

TerenceLockette — Tue, 06 Jul 2021 14:56:54 GMT

Hello all,

Is it possible to migrate a current FTD appliance that is a standalone device to be managed by FMC that's also currently in production? Or do I need to configure all the objects, NATs, rules, etc. on the FMC first then wipe the FTD and start from scratch? Any guidance on this would be greatly appreciated.

Thanks!

Terence

Re: Possible to move standalone FTD to be managed by FMC?

Marvin Rhoads — Tue, 06 Jul 2021 15:17:09 GMT

Changing from local management (or "standalone" as you referred to it) to FMC management does unfortunately require that the current configuration be replaced by what will reside on FMC. Everything except the basic config of the management interface, its gateway etc. will be lost.

Re: Possible to move standalone FTD to be managed by FMC?

TerenceLockette — Tue, 06 Jul 2021 15:19:56 GMT

Thanks, Marvin. That's what I thought as I didn't see a way to do it natively within the FDM so I wanted to confirm if starting from scratch was the only way to do this. However, I can at least pre-configure the network objects and rules in the FMC so that it's ready to be applied to the FTD when it joins, correct?

Re: Possible to move standalone FTD to be managed by FMC?

Marvin Rhoads — Tue, 06 Jul 2021 15:27:57 GMT

You're welcome.

Yes - just about everything can be preconfigured in FMC awaiting assignment to the device once it is added.

The main things I can think of that cannot be configured in advance are the interface and routing settings (configured under the individual device management page in FMC) and, if you have a site to site or remote access VPNs, the settings for those, including the certificate for remote access VPN.

Re: Possible to move standalone FTD to be managed by FMC?

TerenceLockette — Tue, 06 Jul 2021 15:35:06 GMT

Yes exactly which is why I didn't mention routing and interface configs since they're done under the device management menu as you stated. Fortunately, these appliances are in an environment which doesn't require any VPN services and the rules are very small so the work to preconfigure the objects and rules shouldn't be a burden. Thanks for confirming, Marvin!

Much appreciation,

Terence

Re: Possible to move standalone FTD to be managed by FMC?

Eric R. Jones — Tue, 06 Jul 2021 21:37:55 GMT

Nice to see this information; however, being the lazy guy I am, is it possible to use the migration tool to pull the current config off a FTD device and import it into the FMC and then make the other IP changes then add the FTD to the FMC?

Re: Possible to move standalone FTD to be managed by FMC?

Marvin Rhoads — Wed, 07 Jul 2021 07:27:01 GMT

Sorry that's not possible - at least not easily. In theory you could pull everything that's exposed via API on the locally-managed FTD and then map it to what is supported to push via API on FMC. However that would be a lot more work and still leave you with bits to migrate manually.

Re: Possible to move standalone FTD to be managed by FMC?

Eric R. Jones — Wed, 07 Jul 2021 20:56:04 GMT

Thank you.
I was wondering if there was a way to easily migrate FTD's from one
location to another, either by exporting the ACP Rules and re-import them or
use a previous backup and import that to the FMC and then restore to the
newly, and wiped, FTD to be managed.

Re: Possible to move standalone FTD to be managed by FMC?

Marvin Rhoads — Thu, 08 Jul 2021 07:07:19 GMT

It is possible to export ACP rules from one FMC and restore to another. They need to match versions of Firepower software, VDB etc.