topic Re: Can FMC running in vsphere be migrated to AWS? in Network Security

Can FMC running in vsphere be migrated to AWS?

SIMMN — Sat, 12 Mar 2022 17:47:56 GMT

I plan to migrate a FMC running in vsphere to AWS. Initially I plan to: 1. Build the FMC in AWS as brand new; 2. Backup the existing FMC (running v7 already) and then restore the backup in AWS FMC; 3. Login to AWS FMC serial console to change the MGMT IP address.

But after reading the FMC migration guide below, I am not too sure my planned process would work…

https://www.cisco.com/c/en/us/td/docs/security/firepower/fmc_model_migration/b_FMC_Model_Migration_Guide.html

It shows Azure is not supported but what about AWS? From the guide, the supported migration path doesn’t seem support FMCv as the target no matter what is the source model…

So if I read the guide correctly, will I have to do policy export and import in order have the configuration migrated? Plus I donot know if the AWS ec2 serial console would work for FMC instance…

Re: Can FMC running in vsphere be migrated to AWS?

balaji.bandi — Sat, 12 Mar 2022 18:32:04 GMT

I have done deployment in AWS, as per document you get console :

https://www.cisco.com/c/en/us/td/docs/security/firepower/quick_start/fmcv/fpmc-virtual/fpmc-virtual-aws.html#id_71276

Your steps seem to reasonable, you need to the same version, register FTD with the new FMC, before you remove OLD one.

Re: Can FMC running in vsphere be migrated to AWS?

SIMMN — Sat, 12 Mar 2022 18:37:18 GMT

Cool! It is mainly the migration path doc confused me…

so the way to access the AWS FMC serial console would the same as other Linux based EC2 instance?

Re: Can FMC running in vsphere be migrated to AWS?

balaji.bandi — Sat, 12 Mar 2022 18:51:19 GMT

I believe you get the ability of the same to do the task.

Re: Can FMC running in vsphere be migrated to AWS?

Marvin Rhoads — Mon, 14 Mar 2022 10:26:16 GMT

You can temporarily "fool" the Firepower Model Migration Tool by configuring the target FMCv in AWS as a hardware model - an FMC 1600- for example. There is a script that you can run to do this. Run it as root: /var/sf/etc/model-info/configure-model.sh, change the model of the AWS FMC to FMC 1600 and import the backup. After that, rerun the script and revert it to the FMCv for AWS.

root@firepower:/var/sf/backup# /var/sf/etc/model-info/configure-model.sh 

To reset this Cisco Firepower Management Center for VMware to a new model the Cisco Firepower Management Center for VMware
will be stopped and rebooted.

Stop the Cisco Firepower Management Center for VMware to configure new model and reboot? [y/n] y
Stopping Cisco Firepower Management Center for VMware......ok
Please select the model to configure to:

 1) Cisco_Firepower_Management_Center_for_VMware
 2) Cisco_Firepower_Management_Center_for_AWS
 3) Cisco_Firepower_Management_Center_for_KVM
 4) Cisco_Firepower_Management_Center_1000
 5) Cisco_Firepower_Management_Center_2500
 6) Cisco_Firepower_Management_Center_4500
 7) Cisco_Firepower_Management_Center_1600
 😎😎 Cisco_Firepower_Management_Center_2600
 9) Cisco_Firepower_Management_Center_4600
10) Cisco_Firepower_Management_Center_for_Azure
11) Cisco_Firepower_Management_Center_for_GCP
12) Cisco_Firepower_Management_Center_for_VMWare_300
13) Cisco_Firepower_Management_Center_for_OCI
14) Cisco_Firepower_Management_Center_for_OpenStack
Please select model configure to: 7

Configuring for Cisco Firepower Management Center 1600.

Proceeding with reboot of new Cisco Firepower Management Center 1600.


Broadcast message from root@firepower (pts/0) (Wed Mar  9 14:12:08 2022):

The system is going down for reboot NOW!
root@firepower:/var/sf/backup#

Re: Can FMC running in vsphere be migrated to AWS?

SIMMN — Mon, 14 Mar 2022 13:50:13 GMT

Thanks, will give it a try.

Re: Can FMC running in vsphere be migrated to AWS?

SIMMN — Mon, 14 Mar 2022 19:47:46 GMT

@Marvin Rhoads If I set the FMC model to be something else other than the FMCv for AWS, say I set it to FMCv for VMware. Wouldnt I be able to just simply restore my backup captured from the FMC running in VMware?

Re: Can FMC running in vsphere be migrated to AWS?

Marvin Rhoads — Tue, 15 Mar 2022 03:03:11 GMT

Possibly, but I've never tried that.

On the other hand, I have used the method I suggested successfully on two different FMCs in the past month.

Re: Can FMC running in vsphere be migrated to AWS?

SIMMN — Tue, 15 Mar 2022 13:25:51 GMT

Thanks for the confirmation!

Re: Can FMC running in vsphere be migrated to AWS?

jbates5873 — Thu, 23 Feb 2023 01:30:22 GMT

bit of a grave dig on this,

but we are looking to migrate an ESX on-prem instance to Azure.

Based on this thread, and your experience @SIMMN (even though you were AWS) how did you go?

Im thinking we may be able to configure the Azure instance to pretend to match on-prem, restore and re-configre to be azure afterwards. Thoughts?

Re: Can FMC running in vsphere be migrated to AWS?

SIMMN — Thu, 23 Feb 2023 14:03:34 GMT

I basically just "converted" the FMCv for AWS to be FMC 1600 and then used the built-in migration tool with the configuration backup. Then "converted" it back to the FMCv for AWS. I would assume the same could be done for Azure but you might also want to have a plan B prepare in case the method did not work for Azure.

Re: Can FMC running in vsphere be migrated to AWS?

James Petner — Thu, 16 Mar 2023 14:58:03 GMT

@Marvin Rhoads @SIMMN Wondering if either of you have any experience using the 'fool' model method to setup an FMCv HA pair?

For background I'm trying to do the same FMCv on VMware to FMCv on AWS migration this tread is discussing. In my case the Source and Destination FMCv IPs will be different. According to TAC I'm going to have to deregister my FTDs and then re-register them but I'm obviously trying to avoid any downtime, and this would wipe the config in the process, etc...

I see in this documentation that FMCv HA is now supported across all platforms and I meet all the requirements and guidelines in this doc. including the software versions and rules versions matching on both FMCv's. However, when I go to setup the HA I get an error message that says the models don't match because one is on VMware and the other AWS.

Cisco Secure Firewall Management Center Administration Guide, 7.3 - High Availability [Cisco Secure Firewall Management Center] - Cisco

Any thoughts or insights would be greatly appreciated!

Re: Can FMC running in vsphere be migrated to AWS?

SIMMN — Thu, 16 Mar 2023 15:48:29 GMT

I have not done any virtual FMC HA and frankly I really do not see any needs for that.

Re: Can FMC running in vsphere be migrated to AWS?

James Petner — Thu, 16 Mar 2023 16:10:50 GMT

Totally agree that the HA FMCv is overkill in most cases. I'm just looking to use it as a migration tool for right now. Thanks for the feedback.

Re: Can FMC running in vsphere be migrated to AWS?

Marvin Rhoads — Thu, 16 Mar 2023 16:30:10 GMT

The only FMC HA deployments I have encountered have been hardware-based. I've not migrated any to cloud, HA or otherwise.

Re: Can FMC running in vsphere be migrated to AWS?

bill.whelan — Tue, 29 Aug 2023 18:00:21 GMT

Will this method work when migrating from an FMC 1000 to FMCv?

Re: Can FMC running in vsphere be migrated to AWS?

Marvin Rhoads — Tue, 29 Aug 2023 18:40:49 GMT

@bill.whelan yes it will.

Re: Can FMC running in vsphere be migrated to AWS?

rayumang — Thu, 15 Feb 2024 07:58:22 GMT

I have tried this approached but after uploading the backup file, I cannot reach the AWS FMC. Sorry but I am just new to this. Read also that you need to access the console of the AWS to replace the management IP. How to do this?

Appreciate the reply.

Thanks,

Don

Re: Can FMC running in vsphere be migrated to AWS?

Marvin Rhoads — Thu, 15 Feb 2024 16:19:56 GMT

You would have to log into the VM console in AWS and use the configure-network script as root user in expert mode to update the FMC management address.

sudo /usr/local/sf/bin/configure-network

Re: Can FMC running in vsphere be migrated to AWS?

Freemen — Fri, 01 Mar 2024 04:49:57 GMT

which mean i can "fool" a FMCv10 as FMCv300 for achieve my migration from FMC2500 to FMCv?

Cisco Secure Firewall Management Center Model Migration Guide - About Secure Firewall Management Center Model Migration [Cisco Secure Firewall Management Center] - Cisco