topic Re: Moving HA 4115 FTD to new FMC in Network Security

Moving HA 4115 FTD to new FMC

gihernandezn91 — Wed, 12 Apr 2023 02:27:25 GMT

Im tasked to move an HA 4115 FTD to a new FMC. We are going from Physical to Virtual so sadly this does not comply with the supported fmc model migration path shown here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/fmc_model_migration/b_FMC_Model_Migration_Guide/about_fmc_model_migration.html#id_111597

Instead I would need to break HA and join the secondary FTD to the new FMC and configure manually the interfaces and routes. This is based in the following post:

https://community.cisco.com/t5/security-blogs/firepower-threat-defense-ftd-migrations-from-one-fmc-to-another/ba-p/3956939

Just to be clear im not missing anything. This firewalls contains over 20 site to site vpns and several anyconnect portals. Does this migration include re-configuring these vpns manually in the new FMC?

Thanks

Re: Moving HA 4115 FTD to new FMC

balaji.bandi — Wed, 12 Apr 2023 02:30:27 GMT

what is the version of FMC and FTD running ?

Re: Moving HA 4115 FTD to new FMC

gihernandezn91 — Wed, 12 Apr 2023 02:35:37 GMT

7.0.4 both FMC/FTD

Re: Moving HA 4115 FTD to new FMC

balaji.bandi — Wed, 12 Apr 2023 07:28:37 GMT

As per i know that is not support virtual to Azure and other

My suggestion is to install the new appliance and configure it offline (if you looking to use the same IP address) - if a different IP address is easy for Migration.

Follow the below guides :

https://www.cisco.com/c/en/us/td/docs/security/firepower/fmc_model_migration/b_FMC_Model_Migration_Guide/migrate_your_fmc.html

https://antonioyan.wordpress.com/2021/10/05/how-to-migrate-fmc-to-a-new-hardware-appliance/

Re: Moving HA 4115 FTD to new FMC

gihernandezn91 — Wed, 12 Apr 2023 12:35:30 GMT

Thanks!

But these guides do not apply to my scenario since im migrating from pyshical to virtual. if it were from virtual to physical or to a higher capacity FMC it would work using the migration script.

Re: Moving HA 4115 FTD to new FMC

Marvin Rhoads — Wed, 12 Apr 2023 13:23:26 GMT

There is a script on FMC that allows you to "fool" the system into thinking it is a different model. If you use that, you can then use the FMC model migration tool.

A couple of threads have previously described this method and I have used it personally a couple of times successfully.

https://community.cisco.com/t5/network-security/replace-old-fmc-2000-to-new-fmc-1600/m-p/4621736

https://community.cisco.com/t5/network-security/migration-from-vfmc-to-fmc-appliance/td-p/3680345

Re: Moving HA 4115 FTD to new FMC

gihernandezn91 — Wed, 12 Apr 2023 13:41:32 GMT

Thanks!

This is the workaround i was looking for.

But my original question still stands. If i were to migrate the FMC withhout using this script. Would I need to migrate all the vpn configuration manually?

Re: Moving HA 4115 FTD to new FMC

Marvin Rhoads — Wed, 12 Apr 2023 13:51:54 GMT

You're welcome.

If you don't use the script you would indeed need to rebuild everything manually.

Re: Moving HA 4115 FTD to new FMC

balaji.bandi — Wed, 12 Apr 2023 15:05:27 GMT

oh i was thinking other way around, as suggest @Marvin Rhoads script should do your work.